PT-2025-48095 · Victoriametrics · Victoriametrics

Published 2025-11-25 · Updated 2026-01-06 · CVE-2025-65942

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions VictoriaMetrics versions 1.0.0 through 1.110.22 VictoriaMetrics versions 1.111.0 through 1.122.7 VictoriaMetrics versions 1.123.0 through 1.129.0

Description The software is susceptible to Denial of Service (DoS) attacks. The snappy decoder did not enforce VictoriaMetrics request size limits, allowing malformed blocks to cause excessive memory consumption, potentially leading to Out Of Memory (OOM) errors and service instability. The issue is addressed by enforcing block-size checks based on MaxRequest limits.

Recommendations Update to VictoriaMetrics version 1.110.23 or later. Update to VictoriaMetrics version 1.122.8 or later. Update to VictoriaMetrics version 1.129.1 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-65942

GHSA-66JQ-2C23-2XH5

GO-2025-4161

SUSE-SU-2026:0037-1

Affected Products

Victoriametrics

References · 97

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65942.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65942 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66jq-2c23-2xh5 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4161 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65942 · Vendor Advisory
• https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.129.1 · Note
• https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.110.23 · Note
• https://github.com/VictoriaMetrics/VictoriaMetrics/commit/51b44afd34d2c9a392d4ebedeeb5b4a7f5beca24 · Note
• https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-66jq-2c23-2xh5 · Note
• https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.8 · Note
• https://github.com/VictoriaMetrics/VictoriaMetrics · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note
• https://suse.com/security/cve/CVE-2025-10543 · Note