PatchSiren cyber security CVE debrief
CVE-2016-9244 F5 CVE debrief
CVE-2016-9244, commonly referred to as Ticketbleed, is a confidentiality issue in F5 BIG-IP when a virtual server uses a Client SSL profile with the non-default Session Tickets option enabled. A remote attacker can cause up to 31 bytes of uninitialized memory to be returned, which may expose SSL session IDs from other sessions and possibly additional data. NVD rates the issue CVSS 7.5 HIGH.
- Vendor
- F5
- Product
- Unknown
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-02-09
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-02-09
- Advisory updated
- 2026-05-13
Who should care
F5 BIG-IP administrators and security teams responsible for TLS termination, especially environments using Client SSL profiles with Session Tickets enabled on affected BIG-IP modules and versions.
Technical summary
The NVD record classifies this as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Its CVSS v3.0 vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a network-reachable issue with no privileges or user interaction required and high confidentiality impact only. The supplied description limits the leak to up to 31 bytes of uninitialized memory in the affected SSL path.
Defensive priority
High priority for any exposed BIG-IP instance using Client SSL Session Tickets. Because exploitation is remote, unauthenticated, and can disclose session-related data, affected internet-facing TLS endpoints should be reviewed promptly.
Recommended defensive actions
- Inventory BIG-IP virtual servers and Client SSL profiles to identify where the Session Tickets option is enabled.
- Apply F5's mitigation and remediation guidance from the official support advisory for K05121675.
- Disable Session Tickets where they are not operationally required.
- Compare deployed BIG-IP modules and versions against the affected CPE list in the NVD record.
- If exposure is suspected, invalidate affected sessions and review dependent secrets or session-handling assumptions.
- Verify the fix after change deployment and re-scan affected BIG-IP configurations.
Evidence notes
This debrief is based on the supplied CVE/NVD record and the official F5 support advisory reference cited in that record. The corpus confirms the vulnerable configuration, the up-to-31-byte uninitialized-memory leak, the likely exposure of SSL session IDs, and the CVSS/CWE classifications. Version-specific remediation details are not expanded beyond what is present in the supplied corpus and official links.
Sources and references
Verified primary and authoritative sources
-
CVE-2016-9244 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2016-9244
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2016-9244 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9244
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://blog.filippo.io/finding-ticketbleed/
-
Source reference
Unverified legacy reference
URL: https://filippo.io/Ticketbleed/
-
Source reference
Unverified legacy reference
URL: https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://support.f5.com/csp/article/K05121675
[email protected] - Mitigation, Vendor Advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.