CVE-2025-61258CWE-444

CVE-2025-61258

High · published December 9, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

⚡ A crafty content-length mismatch can trigger a denial of service on Outsystems Platform Server 11.18.1.37828! Think of it like an overzealous waiter pouring the wrong amount of soup into a bowl, leaving patrons wanting more while the kitchen scrambles to keep up — it causes chaos! If exploited, this vulnerability could lead to a denial of service, rendering applications unresponsive and frustrating users. Imagine your service crashing just when your customers need it most — absolutely devastating for your reputation!

Put simply

Think of it like an overzealous waiter pouring the wrong amount of soup into a bowl, leaving patrons wanting more while the kitchen scrambles to keep up — it causes chaos! This vulnerability arises from an attacker crafting a content-length value that does not match the actual body length, leading to server confusion and denial of service. Essentially, the server is thrown off balance, unable to process requests correctly.

What to do

If exploited, this vulnerability could lead to a denial of service, rendering applications unresponsive and frustrating users. Imagine your service crashing just when your customers need it most — absolutely devastating for your reputation! To remediate this, upgrade your Outsystems Platform Server to version 11.18.1.37829 or later as soon as possible. Additionally, review incoming request handling to ensure no mismatches can occur in the future. This is fixable! Follow these steps and you'll have your server back on track in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00638 · 49.9th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2025-12-09T23:15Z
Affected products (1)
ProductVersionsFixed in
outsystems/platform_serverall versions—
References (4)
EPSS history
Timeline
  • 09 DEC 00:00Z
    Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the body length
    cvelistv5