Log in Start free

Vulnerability · Published Jun 16, 2025 · Assigned by VulDB

CVE-2025-6140spdlog pattern_formatter-inl.h scoped_padder resource consumption

Low 3.3

In plain English

A low-severity uncontrolled resource consumption in spdlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 83.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, was found in spdlog up to 1.15.1. This affects the function scoped_padder in the library include/spdlog/pattern_formatter-inl.h. The manipulation leads to resource consumption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.2 is able to address this issue. The identifier of the patch is 10320184df1eb4638e253a34b1eb44ce78954094. It is recommended to upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12spdlogno fix listedDEBIAN-CVE-2025-6140
Debian:13spdlog1:1.15.2+ds-1DEBIAN-CVE-2025-6140
Debian:14spdlog1:1.15.2+ds-1DEBIAN-CVE-2025-6140
Ubuntu:22.04:LTSspdlogno fix listedUBUNTU-CVE-2025-6140
Ubuntu:24.04:LTSspdlogno fix listedUBUNTU-CVE-2025-6140

Affected products (as reported)

VendorProductVersions
n/a spdlog 1.15.01.15.1

Weakness: CWE-400, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References