CVE-2025-51495

{
  "id": "CVE-2025-51495",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-29T17:15:31.153",
  "lastModified": "2026-11-07T17:10:00.240",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de desbordamiento de entero en el componente WebSocket de Mongoose 7.5 hasta 7.17. Al enviar una solicitud WebSocket especialmente diseñada, un atacante puede hacer que la aplicación falle. Si los proveedores intermedios integran este componente de forma incorrecta, el problema puede conducir a un desbordamiento de búfer."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-29T19:55:19.399329Z",
          "id": "CVE-2025-51495",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.5",
              "versionEndIncluding": "7.17",
              "matchCriteriaId": "1D589ED4-2625-4BC2-9A2E-136A1B8F6E38"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/cainiao159357/CVE-2025-51495",
      "source": "[email protected]",
      "tags": [
        "Exploit"
      ]
    },
    {
      "url": "https://github.com/cesanta/mongoose",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/cesanta/mongoose/pull/3131",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    }
  ]
}