Skip to main content

Allocation of Resources Without Limits or Throttling

CVE-2025-65942

Low
2.7/10

Summary

VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 through 1.110.22, from 1.111.0 through 1.122.7, and from 1.123.0 through 1.129.0, affected versions are vulnerable to Denial-of-Service(DoS) attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to Out-Of-Memory(OOM) errors and service instability. The fix enforces block-size checks based on "MaxRequest" limits.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • HIGH
  • NONE
  • LOW

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published