CVE-2025-11362CWE-770denial-of-service

CVE-2025-11362

High · published October 7, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-10-07T09:15Z
Affected products (16)
ProductVersionsFixed in
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
pdfmake/pdfmakeall versions—
References (3)
https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed · [email protected]https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14101887 · [email protected]https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297 · [email protected]
EPSS history
Timeline
  • 07 OCT 05:00Z
    Versions of the package pdfmake before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file…
    cvelistv5