CVE-2025-2529

Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from (malicious) external parties in an unfiltered/unsalted way.

CVSS v3 2.9 LOW

2.9^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.4 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7247977	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:terracotta::::::::
	cpe:2.3:a:ibm:terracotta::::::::

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Aplicaciones que utilizan versiones afectadas de Ehcache 3.x pueden experimentar un rendimiento degradado de escritura en caché si la aplicación que utiliza Ehcache utiliza claves procedentes de (maliciosas) partes externas de una manera sin filtrar/sin sal.

Information

Published : 2025-10-15 16:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-2529

Mitre link : CVE-2025-2529

CVE.ORG link : CVE-2025-2529

JSON object : View

Products Affected

ibm

terracotta

CWE

CWE-228

Improper Handling of Syntactically Invalid Structure

NVD-CWE-noinfo

{"id": "CVE-2025-2529", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2529", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-16T13:30:24.959058Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:terracotta:10.15.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:10.15.0:ifix23:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:terracotta:11.1.0:ifix5:*:*:*:*:*:*"], "vendor": "IBM", "product": "Terracotta", "versions": [{"status": "affected", "version": "10.15.0", "versionType": "semver", "lessThanOrEqual": "10.15.0 IF23"}, {"status": "affected", "version": "11.1.0", "versionType": "semver", "lessThanOrEqual": "11.1.0 IF5"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-15T16:15:34.287", "references": [{"url": "https://www.ibm.com/support/pages/node/7247977", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-228"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from (malicious) external parties in an unfiltered/unsalted way."}, {"lang": "es", "value": "Aplicaciones que utilizan versiones afectadas de Ehcache 3.x pueden experimentar un rendimiento degradado de escritura en cach\u00e9 si la aplicaci\u00f3n que utiliza Ehcache utiliza claves procedentes de (maliciosas) partes externas de una manera sin filtrar/sin sal."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:terracotta:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F05CF050-F848-49C6-B5D3-E5EEFEEBD1C1", "versionEndExcluding": "10.15.0.23", "versionStartIncluding": "10.15.0"}, {"criteria": "cpe:2.3:a:ibm:terracotta:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6AC7753-A19D-4BB2-8951-170173B79B00", "versionEndExcluding": "11.1.0.5", "versionStartIncluding": "11.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}