GHSA-cc84-q3v3-mhgf
NoneCVSS
—
EPSS
—
Published
Dec 10, 2025
CISA due date
—
The record
XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-rest-server | 0 | 16.10.11 |
| Maven | org.xwiki.platform:xwiki-platform-rest-server | 17.0.0-rc-1 | 17.4.4 |
| Maven | org.xwiki.platform:xwiki-platform-rest-server | 17.5.0-rc-1 | 17.7.0-rc-1 |
| maven | org.xwiki.platform/xwiki-platform-rest-server | 17.0.0-rc-1 | 17.4.4 |
| maven | org.xwiki.platform/xwiki-platform-rest-server | 17.5.0-rc-1 | 17.7.0-rc-1 |
Related vulnerabilities
- CVE-2025-66473 XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large… Same vulnerability
- CVE-2025-32969 org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of… Also affects org.xwiki.platform:xwiki-platform-rest-server
- CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled… CWE-770
- CVE-2026-96377 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined… CWE-770
- CVE-2026-96365 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform… CWE-770
- CVE-2026-114723 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource… CWE-770
- CVE-2026-113811 Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory… CWE-770
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-770