PT-2025-4271 · Oracle · Oracle Weblogic Server

Published 2025-01-21 · Updated 2025-06-23 · CVE-2025-21549

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server version 14.1.1.0.0

Description The issue allows an unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete Denial of Service) of Oracle WebLogic Server. This vulnerability is related to resource exhaustion, specifically memory depletion, which can be triggered by HTTP requests.

Recommendations For Oracle WebLogic Server version 14.1.1.0.0, consider disabling HTTP/2 access as a temporary workaround until a patch is available. Restrict access to the Core component to minimize the risk of exploitation. Avoid using HTTP requests that may trigger the vulnerability until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2025-01276

CVE-2025-21549

Affected Products

Oracle Weblogic Server

References · 8

• https://oracle.com/security-alerts/cpujan2025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21549 · Security Note
• https://bdu.fstec.ru/vul/2025-01276 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21549 · Vendor Advisory
• https://twitter.com/PVynckier/status/1883514016796217663 · Twitter Post
• https://twitter.com/dailycve/status/1937200872066548193 · Twitter Post
• https://twitter.com/CVEnew/status/1881821733789012258 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1881877405431644417 · Twitter Post