Low severity · published Nov 25, 2025
CVE-2025-65942
VictoriaMetrics Snappy Decoder DoS Vulnerability is Causing OOM
2.7
CVSS
0.4%
EPSS
No
On KEV
Description
VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits. This issue has been patched in versions 1.110.23, 1.122.8, and 1.129.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
VictoriaMetrics · VictoriaMetrics
>= 1.0.0, < 1.110.23; >= 1.111.0, < 1.122.8; >= 1.123.0, < 1.129.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65942
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65942
github.com
https://github.com/VictoriaMetrics/VictoriaMetrics/commit/51b44afd34d2c9a392d4ebedeeb5b4a7f5beca24
github.com
https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.110.23
github.com
https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.8
github.com
https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.129.1
github.com
https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-66jq-2c23-2xh5
More from VictoriaMetrics
6.8
CVE-2026-61625
VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root
3.7
CVE-2026-19898
VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication
