CVE-2025-47148 is a vulnerability classified under CWE-404 (Improper Resource Shutdown or Release) affecting F5 BIG-IP versions 15.1.0, 16.1.0, 17.1.0, and 17.5.0. The issue arises when the BIG-IP system is configured simultaneously as a SAML service provider (SP) and identity provider (IdP), with single logout (SLO) enabled on the access policy. Under these conditions, certain undisclosed requests can cause the system to improperly manage memory resources, resulting in increased memory consumption. This improper resource handling can lead to resource exhaustion, potentially causing denial of service (DoS) by degrading system performance or causing crashes. The vulnerability has a CVSS v3.1 base score of 6.5, indicating medium severity, with an attack vector of network (AV:N), low attack complexity (AC:L), requiring privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), no impact on confidentiality or integrity (C:N/I:N), but high impact on availability (A:H). There are no known exploits in the wild at the time of publication, and no patches have been released yet. The vulnerability affects supported BIG-IP versions only, excluding those that have reached End of Technical Support (EoTS).

For European organizations, especially those using F5 BIG-IP appliances for identity federation and access management, this vulnerability poses a risk of denial of service through memory exhaustion. This can disrupt authentication and authorization services, impacting business continuity and user access to critical applications. Sectors such as finance, telecommunications, government, and critical infrastructure that rely heavily on SAML-based single sign-on (SSO) and single logout (SLO) mechanisms are particularly vulnerable. Service outages could lead to operational downtime, loss of productivity, and potential regulatory compliance issues related to availability. Although the vulnerability does not compromise confidentiality or integrity, the availability impact alone can have significant operational and reputational consequences.

Organizations should immediately review their BIG-IP configurations to identify if the system is set up as both SAML SP and IdP with SLO enabled. Until patches are released, administrators should consider temporarily disabling single logout functionality if feasible, or segregating SP and IdP roles onto separate BIG-IP instances to avoid triggering the vulnerability. Monitoring memory usage and system performance metrics closely can help detect abnormal resource consumption early. Implement network-level protections such as rate limiting or filtering to reduce the risk of undisclosed requests causing resource exhaustion. Engage with F5 support for guidance and prioritize patch deployment as soon as vendor updates become available. Additionally, conduct thorough testing in staging environments before applying any configuration changes or patches in production.