PT-2025-7629 · Lakefs · Lakefs

Arielshaqed · Published 2025-02-21 · Updated 2025-03-13 · CVE-2025-27100

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lakeFS versions 1.49.1 and earlier

Description lakeFS is an open-source tool that transforms object storage into a Git-like repository. In affected versions, an authenticated user can crash lakeFS by exhausting server memory, resulting in an authenticated denial-of-service issue. This problem has been solved in version 1.50.0.

Recommendations For versions 1.49.1 and earlier, update to version 1.50.0 or later to resolve the issue. As a temporary workaround for users unable to upgrade, set the environment variable LAKEFS BLOCKSTORE S3 DISABLE PRE SIGNED MULTIPART to true or configure the disable pre signed multipart key to true in the config yaml.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-27100

GHSA-J7JW-28JM-WHR6

GO-2025-3479

OPENSUSE-SU-2025:14889-1

Affected Products

Lakefs

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27100.json · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:14889-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27100 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27100 · Security Note
• https://osv.dev/vulnerability/GO-2025-3479 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j7jw-28jm-whr6 · Vendor Advisory
• https://github.com/treeverse/lakeFS · Note
• https://github.com/treeverse/lakeFS/security/advisories/GHSA-j7jw-28jm-whr6 · Note
• https://github.com/treeverse/lakeFS/commit/3a625752acdf3f8e137bec20451e71d0f9fa82f2 · Note
• https://suse.com/security/cve/CVE-2025-23388 · Note
• https://suse.com/security/cve/CVE-2025-27144 · Note
• https://suse.com/security/cve/CVE-2025-25199 · Note
• https://suse.com/security/cve/CVE-2025-27155 · Note
• https://suse.com/security/cve/CVE-2025-23387 · Note
• https://suse.com/security/cve/CVE-2025-27090 · Note