Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

Blue_whale's avatar
Blue_whale
Icon for Cirrocumulus rankCirrocumulus
Mar 24, 2026

[ASM] : "Request length exceeds defined buffer size " - How to increase the limit ?

Hi Experts , 

 

WAF is rejecting the request because it exceeds the maximum allowed request size (10MB)

 

Requested URL : [HTTPS] /stock.option

Host : trade-it.ifund.com

 

 

Detected Request Length : 12005346 bytes ( 12 MB )

Expected Request Length : 10000000 bytes ( 10 MB )

 

How to increase the limit specific to this url/uri only ?

 

9 Replies

  • I am not aware of an option that does this for a specific URL.
    My suggestion is to change the long_request_buffer_size as described in K01235989 and activate an iRule/LTM policy that blocks larger requests on all other URL and virtual servers (if needed).

    Alternatively you can bypass the ASM for the path completely (K22021244)

  • Hi Blue_whale​,

    to my knowledge you cannot extend the limit per URL, but you can unblock a request which triggers this violation for a specific URL with an iRule:

    when ASM_REQUEST_DONE {
        if {[ASM::violation names] contains "VIOLATION_REQUEST_TOO_LONG" and [string tolower [HTTP::uri]] starts_with "/stock.option"} {
            ASM::unblock        
        } 
    }

    Cheers

    Daniel

    • ASCapi's avatar
      ASCapi
      Icon for Cirrus rankCirrus

      Yet I can not say if it recommended to change de default value. Of course if you're sure that is false-positive so it takes sense

      • Good point ASCapi​. From my experience I can say that the default value is low. However I wouldn't give any recommendation for a one-size-fits-all value to apply in any environment.

    • Blue_whale's avatar
      Blue_whale
      Icon for Cirrocumulus rankCirrocumulus

      Hi ASCapi​

       

      Thank you for the reply . 

      Can you guide me how to change the system variable on GUI or on command line ..what is the command ?