CVE-2025-1695CWE-835

NGINX Unit Java Vulnerability

Medium · published March 4, 2025

CVSS v4.0
6.9
EPSS
1%
Percentile
47.6
In the wild
Unconfirmed
What it is

In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an increase in CPU resource utilization. This vulnerability allows a remote attacker to cause a degradation that can lead to a limited denial-of-service (DoS).  There is no control plane exposure; this is a data plane issue only.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00592 · 47.6th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2025-03-04T00:54Z
EPSS history
Timeline
  • 04 MAR 00:54Z
    NGINX Unit Java Vulnerability
    cvelistv5