Resource exhaustion in Victoriametrics

CVE-2025-65942

VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits. This issue has been patched in versions 1.110.23, 1.122.8, and 1.129.1.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.003 (25.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 25.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-65942: held from 0.003 to 0.003.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

  • Victoriametrics — versions >= 1.0.0, < 1.110.23, >= 1.111.0, < 1.122.8, >= 1.123.0, < 1.129.1

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2025-65942?
CVE-2025-65942 is a low-severity vulnerability in Victoriametrics, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 2.7/10. Published 2025-11-25.
How severe is CVE-2025-65942?
Low severity. CVSS v3 base score is 2.7 out of 10.