Log in Start free

Vulnerability · Published Nov 25, 2025 · Assigned by GitHub_M

CVE-2025-65942VictoriaMetrics Snappy Decoder DoS Vulnerability is Causing OOM

Low 2.7

In plain English

A low-severity resource allocation without limits in VictoriaMetrics from VictoriaMetrics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.4%top 69.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits. This issue has been patched in versions 1.110.23, 1.122.8, and 1.129.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/VictoriaMetrics/VictoriaMetrics1.129.1GHSA-66jq-2c23-2xh5
Gogithub.com/VictoriaMetrics/VictoriaMetrics1.122.8GHSA-66jq-2c23-2xh5
Gogithub.com/VictoriaMetrics/VictoriaMetrics1.110.23GHSA-66jq-2c23-2xh5
Gogithub.com/VictoriaMetrics/VictoriaMetrics1.110.23, 1.122.8, 1.129.1GO-2025-4161

Affected products (as reported)

VendorProductVersions
VictoriaMetrics VictoriaMetrics >= 1.0.0, < 1.110.23>= 1.111.0, < 1.122.8>= 1.123.0, < 1.129.1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

References