CVE-2025-2529

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-2529", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-03-19T15:07:16.690Z", "datePublished": "2025-10-15T15:29:04.780Z", "dateUpdated": "2025-10-16T13:30:34.433Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:terracotta:10.15.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:10.15.0:ifix23:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:11.1.0:ifix5:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Terracotta", "vendor": "IBM", "versions": [{"lessThanOrEqual": "10.15.0 IF23", "status": "affected", "version": "10.15.0", "versionType": "semver"}, {"lessThanOrEqual": "11.1.0 IF5", "status": "affected", "version": "11.1.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from (malicious) external parties in an unfiltered/unsalted way."}], "value": "Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from (malicious) external parties in an unfiltered/unsalted way."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-228", "description": "CWE-228 Improper Handling of Syntactically Invalid Structure", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-10-15T15:29:04.780Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7247977"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM strongly recommends addressing the low severity vulnerability now by applying the mentioned fixes or later fixes for the affected versions and following the respective readme document.</p><p>IBM Terracotta 11.1.0 Fix 6 or later<br>IBM Terracotta 10.15.0 Fix 24 or later</p><p>Fixes can be downloaded and installed via IBM webMethods Update Manager. Refer to How to Download webMethods Software (<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7232491\">https://www.ibm.com/support/pages/node/7232491</a>)</p>\n\n<br>"}], "value": "IBM strongly recommends addressing the low severity vulnerability now by applying the mentioned fixes or later fixes for the affected versions and following the respective readme document.\n\nIBM Terracotta 11.1.0 Fix 6 or later\nIBM Terracotta 10.15.0 Fix 24 or later\n\nFixes can be downloaded and installed via IBM webMethods Update Manager. Refer to How to Download webMethods Software ( https://www.ibm.com/support/pages/node/7232491 )"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Terracotta denial of service", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-16T13:30:24.959058Z", "id": "CVE-2025-2529", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T13:30:34.433Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2529", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-16T13:30:24.959058Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T13:30:28.997Z"}}], "cna": {"title": "IBM Terracotta denial of service", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:terracotta:10.15.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:10.15.0:ifix23:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:11.1.0:ifix5:*:*:*:*:*:*"], "vendor": "IBM", "product": "Terracotta", "versions": [{"status": "affected", "version": "10.15.0", "versionType": "semver", "lessThanOrEqual": "10.15.0 IF23"}, {"status": "affected", "version": "11.1.0", "versionType": "semver", "lessThanOrEqual": "11.1.0 IF5"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the low severity vulnerability now by applying the mentioned fixes or later fixes for the affected versions and following the respective readme document.\n\nIBM Terracotta 11.1.0 Fix 6 or later\nIBM Terracotta 10.15.0 Fix 24 or later\n\nFixes can be downloaded and installed via IBM webMethods Update Manager. Refer to How to Download webMethods Software ( https://www.ibm.com/support/pages/node/7232491 )", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the low severity vulnerability now by applying the mentioned fixes or later fixes for the affected versions and following the respective readme document.</p><p>IBM Terracotta 11.1.0 Fix 6 or later<br>IBM Terracotta 10.15.0 Fix 24 or later</p><p>Fixes can be downloaded and installed via IBM webMethods Update Manager. Refer to How to Download webMethods Software (<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7232491\">https://www.ibm.com/support/pages/node/7232491</a>)</p>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7247977", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from (malicious) external parties in an unfiltered/unsalted way.", "supportingMedia": [{"type": "text/html", "value": "Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from (malicious) external parties in an unfiltered/unsalted way.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-228", "description": "CWE-228 Improper Handling of Syntactically Invalid Structure"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-10-15T15:29:04.780Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2529", "state": "PUBLISHED", "dateUpdated": "2025-10-16T13:30:34.433Z", "dateReserved": "2025-03-19T15:07:16.690Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-10-15T15:29:04.780Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:terracotta:10.15.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:10.15.0:ifix23:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:11.1.0:ifix5:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Terracotta", "vendor": "IBM", "versions": [{"lessThanOrEqual": "10.15.0 IF23", "status": "affected", "version": "10.15.0", "versionType": "semver"}, {"lessThanOrEqual": "11.1.0 IF5", "status": "affected", "version": "11.1.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:terracotta:*:*:*:*:*:*:*:*", "matchCriteriaId": "F05CF050-F848-49C6-B5D3-E5EEFEEBD1C1", "versionEndExcluding": "10.15.0.23", "versionStartIncluding": "10.15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:terracotta:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6AC7753-A19D-4BB2-8951-170173B79B00", "versionEndExcluding": "11.1.0.5", "versionStartIncluding": "11.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from (malicious) external parties in an unfiltered/unsalted way."}, {"lang": "es", "value": "Aplicaciones que utilizan versiones afectadas de Ehcache 3.x pueden experimentar un rendimiento degradado de escritura en cach\u00e9 si la aplicaci\u00f3n que utiliza Ehcache utiliza claves procedentes de (maliciosas) partes externas de una manera sin filtrar/sin sal."}], "id": "CVE-2025-2529", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 1.4, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2529", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-16T13:30:24.959058Z", "version": "2.0.3"}}]}, "published": "2025-10-15T16:15:34.287", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7247977"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-228"}], "source": "psirt@us.ibm.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}