High severity · published Sep 8, 2022
CVE-2022-25897
Denial of Service (DoS)
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
org.eclipse.milo:sdk-server ·
before 0.6.8 · source: vendor
MI
Milo · Eclipse
before 0.6.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25897
Patch
https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5
Issue Tracking
https://github.com/eclipse/milo/issues/1030
Patch
https://github.com/eclipse/milo/pull/1031
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191