What is CVE-2018-5743?

CVE-2018-5743 is a high-severity vulnerability in F5 Big-Ip Access Policy Manager, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2019-10-09.

How severe is CVE-2018-5743?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2018-5743 known to be exploited?

11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in F5 Big-Ip Access Policy Manager

CVE-2018-5743

By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743.

Published 2019-10-09 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.065 (93.5th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 93.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.065 · newest: 0.065 · change: 0.000

Affected products

F5 Big-Ip Access Policy Manager — versions 15.0.0
F5 Big-Ip Advanced Firewall Manager — versions 15.0.0
F5 Big-Ip Analytics — versions 15.0.0
F5 Big-Ip Application Acceleration Manager — versions 15.0.0
F5 Big-Ip Application Security Manager — versions 15.0.0
F5 Big-Ip Domain Name System — versions 15.0.0
F5 Big-Ip Edge Gateway — versions 15.0.0
F5 Big-Ip Fraud Protection Service — versions 15.0.0
F5 Big-Ip Global Traffic Manager — versions 15.0.0
F5 Big-Ip Link Controller — versions 15.0.0

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

Public proof-of-concept exploits

References

kb.isc.org/docs/cve-2018-5743 (Third Party Advisory)
www.synology.com/security/advisory/Synology_SA_19_20
support.f5.com/csp/article/K74009656

Frequently asked questions

What is CVE-2018-5743?: CVE-2018-5743 is a high-severity vulnerability in F5 Big-Ip Access Policy Manager, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2019-10-09.
How severe is CVE-2018-5743?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2018-5743 known to be exploited?: 11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.