CVE-2025-65942Low· 2.7▾ SunlitVictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM
▾ Sunlit zone — Low / medium · no exploitation signal
impact 14.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
Affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits.
Versions 1.129.1, 1.122.8, 1.110.23
VictoriaMetrics' security model assumes its APIs are properly secured (e.g. via access control flags or a firewall); this advisory addresses malicious input that should not be possible under a correctly secured deployment.
github.com/VictoriaMetrics/VictoriaMetrics >= 1.123.0, < 1.129.1github.com/VictoriaMetrics/VictoriaMetrics >= 1.111.0, < 1.122.8github.com/VictoriaMetrics/VictoriaMetrics >= 1.0.0, < 1.110.23Upgrade to a patched release:
github.com/VictoriaMetrics/VictoriaMetrics 1.129.1github.com/VictoriaMetrics/VictoriaMetrics 1.122.8github.com/VictoriaMetrics/VictoriaMetrics 1.110.23Connected by shared product, vendor, weakness, or advisory.