BugZero | F5 BugID 987977 - VIOL_HTTP_RESPONSE_STATUS is set in violation

F5 - Defect ID: 987977

VIOL_HTTP_RESPONSE_STATUS is set in violation_details of remote logging message even if ALM/BLK flags are disabled for the violation

F5 - Defect ID: 987977

VIOL_HTTP_RESPONSE_STATUS is set in violation_details of remote logging message even if ALM/BLK flags are disabled for the violation

Last updated on July 18th, 2026

BugZero Risk Score
6.0 Medium

Overall: 6.0

Severity: 6.4

Community: 4.2

Lifecycle: 8.3

What is the BugZero Risk Score?

F5 Integration

Learn more about where this data comes from

F5 Integration

Learn more

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

Learn more

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Learn more

Bug Details

Priority: 4-Minor
Status: Verified
Impact Category: Application Security Manager
Views: 1

Description

Symptoms

Remote logging message, violation_details field, includes XML document for VIOL_HTTP_RESPONSE_STATUS even though it is configured not to do so (Learn/Alarm/Block are all disabled) with VIOL_HTTP_RESPONSE_STATUS violation.

Impact

Remote logging server receives inaccurate message.

Conditions

When all the following conditions are met -- Response status code is not one of 'Allowed Response Status Codes'. -- Learn/Alarm/Block flags are disabled with 'Illegal HTTP status in response'. -- Logging profile is configured for remote storage. -- Storage format is comma-separated. -- Both violation_details and violations fields are set.

Workaround

None

Fix Information

No longer includes 'violation_details' field in remote logging message in the scenario, but includes it only when it is appropriate.

Change history

Links

Original Vendor Announcement

Relevant Products

Click on a version to see all relevant bugs

Affected versions:13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4, 13.1.1.5, 13.1.3, 13.1.3.1, 13.1.3.2, 13.1.3.3, 13.1.3.4, 13.1.3.5, 13.1.3.6, 13.1.4, 13.1.4.1, 13.1.5, 13.1.5.1, 14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.0.0.5, 14.0.1, 14.0.1.1, 14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 14.1.2.8, 14.1.3, 14.1.3.1, 14.1.4, 14.1.4.1, 14.1.4.2, 14.1.4.3, 14.1.4.4, 14.1.4.5, 14.1.4.6, 14.1.5, 14.1.5.1, 14.1.5.2, 14.1.5.3, 14.1.5.4, 14.1.5.6, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3, 15.1.10.4, 15.1.10.5, 15.1.10.6, 15.1.10.7, 16.0.0, 16.0.0.1, 16.0.1, 16.0.1.1, 16.0.1.2, 16.1.0, 16.1.1, 16.1.2, 16.1.2.1, 16.1.2.2, 16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 16.1.4, 16.1.4.1, 16.1.4.2, 16.1.4.3

Fixed versions: 17.5.0, 17.1.1, 16.1.5, 15.1.10.8

Relevant Products

Click on a version to see all relevant bugs

Fixed versions: 17.5.0, 17.1.1, 16.1.5, 15.1.10.8

Top F5 Defects

9.6Defect ID: 546260
TMM can crash if using the v6rd profile
9.6Defect ID: 934133
Unable to Create/delete ltm virtual server via CLI transaction when destination is not specified on the ltm virtual object
9.6Defect ID: 1154417
Profile based attack is not mitigated at hardware on L2 wire setup
9.6Defect ID: 913713
Rebooting a blade causes MCPd to core as it rejoins the cluster
9.6Defect ID: 2141125
Multicast traffic is dropped with incorrect VLAN tagging

F5 Integration

Learn more about where this data comes from

F5 Integration

Learn more

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

Learn more

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Learn more

Ready to prevent the next vendor outage?

Get a demo

F5 - Defect ID: 987977

VIOL_HTTP_RESPONSE_STATUS is set in violation_details of remote logging message even if ALM/BLK flags are disabled for the violation

F5 - Defect ID: 987977

VIOL_HTTP_RESPONSE_STATUS is set in violation_details of remote logging message even if ALM/BLK flags are disabled for the violation

Last updated on July 18th, 2026

BugZero Risk Score6.0 Medium

Bug Details

Symptoms

Impact

Conditions

Workaround

Fix Information

Links

Top F5 Defects

Ready to prevent the next vendor outage?

F5 - Defect ID: 987977

VIOL_HTTP_RESPONSE_STATUS is set in violation_details of remote logging message even if ALM/BLK flags are disabled for the violation

F5 - Defect ID: 987977

VIOL_HTTP_RESPONSE_STATUS is set in violation_details of remote logging message even if ALM/BLK flags are disabled for the violation

Last updated on July 18th, 2026

BugZero Risk Score6.0 Medium

Bug Details

Symptoms

Impact

Conditions

Workaround

Fix Information

Links

Top F5 Defects

Ready to prevent the next vendor outage?

BugZero Risk Score
6.0 Medium

BugZero Risk Score
6.0 Medium