CVE-2025-11362
Full vulnerability record from the local CVENow database.
Description
Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Modified
Source identifier
Published
2025-10-07 05:15:33.787000
Last modified
2026-10-19 16:10:00.260000
View original CVE JSON
{
"id": "CVE-2025-11362",
"sourceIdentifier": "[email protected]",
"published": "2025-10-07T05:15:33.787",
"lastModified": "2026-10-19T16:10:00.260",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition."
},
{
"lang": "es",
"value": "Las versiones del paquete pdfmake anteriores a la 0.3.0-beta.17 son vulnerables a la Asignación de Recursos Sin Límites o Limitación (Allocation of Resources Without Limits or Throttling) mediante la redirección repetida de URL en la incrustación de archivos. Un atacante puede hacer que la aplicación falle o deje de responder al proporcionar una entrada manipulada que desencadene esta condición."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n/a",
"product": "pdfmake",
"versions": [
{
"version": "0.3.0-beta.1",
"lessThan": "0.3.0-beta.17",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "n/a",
"product": "org.webjars.npm:pdfmake",
"versions": [
{
"version": "0.3.0-beta.1",
"lessThan": "0.3.0-beta.18",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-07T18:28:56.731902Z",
"id": "CVE-2025-11362",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "66C8AC2C-2DC7-4934-83A0-CCB117E42E30"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta10:*:*:*:*:*:*",
"matchCriteriaId": "6E9F434F-B222-4B9E-894F-EF27349FD85A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta11:*:*:*:*:*:*",
"matchCriteriaId": "302CBC0D-4021-43C9-9214-258EFAEBADA0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta12:*:*:*:*:*:*",
"matchCriteriaId": "813FC92B-1352-46B2-98E5-177F2774A2FF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta13:*:*:*:*:*:*",
"matchCriteriaId": "6998E01F-28D0-4110-9B73-051917FC1786"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta14:*:*:*:*:*:*",
"matchCriteriaId": "3AE1D6C1-6D1F-40E2-A56B-D8975F41CF58"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta15:*:*:*:*:*:*",
"matchCriteriaId": "A208BAFD-8F2C-4A30-87BC-9B9A4051113F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta16:*:*:*:*:*:*",
"matchCriteriaId": "3D03BA7A-C32D-4FBA-8A45-3BB1EDFAA456"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "438BF14C-6B93-4D8C-BF7E-C7BA40E04595"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "99C6EF3B-B002-4EB4-96DB-DFFFFED5570F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "60BC0F53-38A5-4BFD-95AC-47B7635BA52E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "5F25A975-45B3-4D96-A3DA-EF388D7C0C78"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "50BDBDEA-E9AA-4D3D-B0C1-35552D2A6FE0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta7:*:*:*:*:*:*",
"matchCriteriaId": "8C08D75E-8340-4522-88C5-3871B461EA63"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta8:*:*:*:*:*:*",
"matchCriteriaId": "FC47E00A-8A0D-4D66-BA63-9D9400584815"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta9:*:*:*:*:*:*",
"matchCriteriaId": "76F34238-5ADD-4491-A01F-ECD62ECF10DB"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14101887",
"source": "[email protected]"
},
{
"url": "https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}