PT-2025-32214 · Unknown · Middleware

Jub0Bs · Published 2024-07-02 · Updated 2025-12-18 · CVE-2025-47908

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Middleware (affected versions not specified)

Description The middleware experiences excessive heap allocations when handling malicious preflight requests containing a large number of commas within the Access-Control-Request-Headers (ACRH) header. This can lead to undue load on the middleware/server, potentially resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-79

CWE-770

Related Identifiers

BDU:2026-03416

CVE-2025-47908

GHSA-MH55-GQVF-XFWM

GHSA-VH9X-PHQ6-FX54

GO-2024-2883

OPENSUSE-SU-2025:15424-1

SUSE-SU-2025:3817-1

SUSE-SU-2025:3819-1

SUSE-SU-2025:4457-1

SUSE-SU-2025:4481-1

Affected Products

Middleware

References · 113

• https://osv.dev/vulnerability/SUSE-SU-2025:4481-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-47908 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3817-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vh9x-phq6-fx54 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2883 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-47908 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3819-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mh55-gqvf-xfwm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47908 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-47908 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15424-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47908 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03416 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:4457-1 · Vendor Advisory
• https://github.com/rs/cors/issues/170 · Note