Security1 publisher2 min readPublished
F5 fixes CVE-2026-94127 by capping the Authorization header at 16,640 bytes
watchTowr diffed two builds of BIG-IP's tmm64 and found that F5's fix for CVE-2026-94127 is a single length test on the Authorization header, a field parsed at the edge. watchTowr says attackers were already exploiting it.
The Watch · Security desk
What happened
- F5 published advisory K000162605 for CVE-2026-94127 on September 22, and watchTowr Labs published its patch-diff teardown of the bug the following day.
- The hotfix adds a single size test on the Authorization header, rejecting anything larger than 0x4100 bytes with the error string "Authorization header too big."
- watchTowr's comparison ran between BIG-IP 21.1.0 build 0.0.38 and the 21.1.0.2 hotfix build 0.30.22.
- watchTowr wrote that people on the internet were already exploiting the vulnerability, and titled the writeup an unauthenticated heap overflow leading to remote code execution.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The header is parsed on the traffic path of a virtual server, not in the admin interface, so keeping TMUI on a management network does not cover this one.
- capability Defenders get a concrete threshold: 16,640 bytes of Authorization header is the line F5's own code now treats as invalid.
- decision Because the fix is a length cap, anything upstream that can reject oversize Authorization headers approximates it while a hotfix window gets scheduled.
- constraint The teardown validates one version pair, so operators on older BIG-IP trains have to map their build against F5's KB before assuming the same hotfix line covers them.
The change is one bounds test, and what it replaced is the interesting part. In the vulnerable build, the function watchTowr labels sub_10B01C0 hands the Authorization header length straight to a copy helper, sub_1527C00, as its size argument [6][7]. The hotfix version, sub_10B0E00, runs the length comparison first and returns an error before the copy executes [5][7].
0x4100 is 16,640 bytes: 0x4000 is 16,384, and 0x100 adds 256 [13]. Any request log or proxy that records header sizes can be queried against that number now, without waiting for a signature feed.
The diff itself was not subtle work. watchTowr pushed the tmm64 binaries from both builds through IDA and Diaphora, exporting 1,728 functions from each for comparison, and the result was a single changed function pair [4][7]. F5's advisory K000162605 carries the affected version list, and the post points readers there for it [14].
On exploitation, the post is first-hand only about the patch. watchTowr wrote that "There were bad people on the Internet exploiting it" [9]. No actor is named and no indicators are published [16]. It also warns off the shortcut defenders reach for first. "those slop-ridden payloads appearing in your access_log are not proof of exploitation", watchTowr wrote [12].
Placement is what makes this worth an out-of-band window. A BIG-IP does Layer 4 and Layer 7 traffic management, SSL/TLS offloading, DNS and global server load balancing, and, with the licenses signed off, Advanced WAF and the APM remote access and SSO gateway, all on TMOS [11]. watchTowr described the appliance as one that "lives at the very edge of your network, terminates your TLS, sees all of your traffic in plaintext, and holds the keys to your authentication" [10].
The lab configuration is a hint about reachability. watchTowr reproduced on a virtual server with an OAuth profile configured [8], which is where an Authorization header is meant to be parsed and validated. Whether the same path is reachable on a virtual server without that profile is not established by the published analysis [16].
What to watch
- Whether F5 updates K000162605 with exploitation detail or indicators beyond the affected version list.
- A CISA KEV listing for CVE-2026-94127 and the federal remediation date that would come with it.
- Follow-up analysis showing whether the overflow is reachable on virtual servers with no OAuth profile configured.