PT-2026-6873 · Hcl · Hcl Velocity

Published 2026-02-07 · Updated 2026-02-07 · CVE-2025-31990

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HCL Velocity versions prior to 5.1.7

Description Rate limiting is not enforced for certain API calls, which makes the software vulnerable to Denial of Service (DoS) attacks. An attacker could send a large number of requests to overwhelm the system’s resources, causing it to become unresponsive to legitimate users.

Recommendations Update to version 5.1.7 or later.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-31990

Affected Products

Hcl Velocity

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-31990 · Security Note
• https://t.me/CVEtracker/44000 · Telegram Post
• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128585 · Note