PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9244 F5 CVE debrief

CVE-2016-9244, commonly referred to as Ticketbleed, is a confidentiality issue in F5 BIG-IP when a virtual server uses a Client SSL profile with the non-default Session Tickets option enabled. A remote attacker can cause up to 31 bytes of uninitialized memory to be returned, which may expose SSL session IDs from other sessions and possibly additional data. NVD rates the issue CVSS 7.5 HIGH.

Vendor
F5
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-09
Original CVE updated
2026-05-13
Advisory published
2017-02-09
Advisory updated
2026-05-13

Who should care

F5 BIG-IP administrators and security teams responsible for TLS termination, especially environments using Client SSL profiles with Session Tickets enabled on affected BIG-IP modules and versions.

Technical summary

The NVD record classifies this as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Its CVSS v3.0 vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a network-reachable issue with no privileges or user interaction required and high confidentiality impact only. The supplied description limits the leak to up to 31 bytes of uninitialized memory in the affected SSL path.

Defensive priority

High priority for any exposed BIG-IP instance using Client SSL Session Tickets. Because exploitation is remote, unauthenticated, and can disclose session-related data, affected internet-facing TLS endpoints should be reviewed promptly.

Recommended defensive actions

  • Inventory BIG-IP virtual servers and Client SSL profiles to identify where the Session Tickets option is enabled.
  • Apply F5's mitigation and remediation guidance from the official support advisory for K05121675.
  • Disable Session Tickets where they are not operationally required.
  • Compare deployed BIG-IP modules and versions against the affected CPE list in the NVD record.
  • If exposure is suspected, invalidate affected sessions and review dependent secrets or session-handling assumptions.
  • Verify the fix after change deployment and re-scan affected BIG-IP configurations.

Evidence notes

This debrief is based on the supplied CVE/NVD record and the official F5 support advisory reference cited in that record. The corpus confirms the vulnerable configuration, the up-to-31-byte uninitialized-memory leak, the likely exposure of SSL session IDs, and the CVSS/CWE classifications. Version-specific remediation details are not expanded beyond what is present in the supplied corpus and official links.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9244 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9244

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9244 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9244

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.