{"id":"CVE-2025-22166","title":"This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unava…","summary":"This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unava…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-405"],"vendor":"atlassian","product":"confluence_data_center","affected":["confluence_data_center >= 8.5.0, < 8.5.25","confluence_data_center >= 9.2.0, < 9.2.7","confluence_data_center >= 10.0.0, < 10.0.2","confluence_server >= 8.5.0, < 8.5.25","confluence_server >= 9.2.0, < 9.2.7","confluence_server >= 10.0.0, < 10.0.2"],"patched":["confluence_data_center 10.0.2","confluence_server 10.0.2"],"published":"2025-10-21","updated":"2026-09-30","sourceUpdated":"2026-09-30T23:10:00.237","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-22166","references":[{"url":"https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034","label":"security@atlassian.com"},{"url":"https://jira.atlassian.com/browse/CONFSERVER-100907","label":"security@atlassian.com"}],"tags":["nvd"],"epss":0.00507,"epssPercentile":0.41023,"ingestedAt":"2026-09-30T23:29:32.436Z","slug":"CVE-2025-22166","body":"## Overview\n\nThis High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.\r\n\r\nThis DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.\r\n\r\nAtlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25\r\n Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7\r\n Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2\r\n\r\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\r\n\r\nThis vulnerability was reported via our Atlassian (Internal) program.\n\n## Affected\n\n- `confluence_data_center >= 8.5.0, < 8.5.25`\n- `confluence_data_center >= 9.2.0, < 9.2.7`\n- `confluence_data_center >= 10.0.0, < 10.0.2`\n- `confluence_server >= 8.5.0, < 8.5.25`\n- `confluence_server >= 9.2.0, < 9.2.7`\n- `confluence_server >= 10.0.0, < 10.0.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `confluence_data_center 10.0.2`\n- `confluence_server 10.0.2`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}