VictoriaMetrics up to 1.110.22/1.122.7/1.129.0 allocation of resources

Summaryinfo

A vulnerability classified as problematic was found in VictoriaMetrics up to 1.110.22/1.122.7/1.129.0. This vulnerability affects unknown code. Such manipulation leads to allocation of resources. This vulnerability is listed as CVE-2025-65942. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in VictoriaMetrics up to 1.110.22/1.122.7/1.129.0. Affected by this issue is an unknown function. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is availability. CVE summarizes:

VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits. This issue has been patched in versions 1.110.23, 1.122.8, and 1.129.1.

The advisory is available at github.com. This vulnerability is handled as CVE-2025-65942 since 11/18/2025. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 1.110.23, 1.122.8 or 1.129.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 51b44afd34d2c9a392d4ebedeeb5b4a7f5beca24 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-199645). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• VictoriaMetrics

Version

• 1.110.0
• 1.110.1
• 1.110.2
• 1.110.3
• 1.110.4
• 1.110.5
• 1.110.6
• 1.110.7
• 1.110.8
• 1.110.9
• 1.110.10
• 1.110.11
• 1.110.12
• 1.110.13
• 1.110.14
• 1.110.15
• 1.110.16
• 1.110.17
• 1.110.18
• 1.110.19
• 1.110.20
• 1.110.21
• 1.110.22
• 1.122.0
• 1.122.1
• 1.122.2
• 1.122.3
• 1.122.4
• 1.122.5
• 1.122.6
• 1.122.7
• 1.129

License

• open-source

Website

• Product: https://github.com/VictoriaMetrics/VictoriaMetrics/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion