---
id: CVE-2025-65942
aliases:
  - GHSA-66jq-2c23-2xh5
  - GO-2025-4161
title: VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM
summary: VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L'
vendor: VictoriaMetrics
product: github.com/VictoriaMetrics/VictoriaMetrics
ecosystem: go
affected:
  - 'github.com/VictoriaMetrics/VictoriaMetrics >= 1.123.0, < 1.129.1'
  - 'github.com/VictoriaMetrics/VictoriaMetrics >= 1.111.0, < 1.122.8'
  - 'github.com/VictoriaMetrics/VictoriaMetrics >= 1.0.0, < 1.110.23'
patched:
  - github.com/VictoriaMetrics/VictoriaMetrics 1.129.1
  - github.com/VictoriaMetrics/VictoriaMetrics 1.122.8
  - github.com/VictoriaMetrics/VictoriaMetrics 1.110.23
published: '2025-11-25'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:30.473392190Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-66jq-2c23-2xh5'
references:
  - url: >-
      https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-66jq-2c23-2xh5
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-65942'
  - url: >-
      https://github.com/VictoriaMetrics/VictoriaMetrics/commit/51b44afd34d2c9a392d4ebedeeb5b4a7f5beca24
  - url: 'https://github.com/VictoriaMetrics/VictoriaMetrics'
  - url: 'https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.110.23'
  - url: 'https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.8'
  - url: 'https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.129.1'
tags:
  - osv
  - go
epss: 0.00341
epssPercentile: 0.25045
ingestedAt: '2026-09-12T03:13:01.757Z'
---

## Overview

### Impact
Affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits.

### Patches
Versions 1.129.1, 1.122.8, 1.110.23

### Resources
 - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.129.1
 - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.8
 - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.110.23
 
### Note 
VictoriaMetrics' security model assumes its APIs are properly secured (e.g. via access control flags or a firewall); this advisory addresses malicious input that should not be possible under a [correctly secured](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#security) deployment.

## Affected packages

- `github.com/VictoriaMetrics/VictoriaMetrics >= 1.123.0, < 1.129.1`
- `github.com/VictoriaMetrics/VictoriaMetrics >= 1.111.0, < 1.122.8`
- `github.com/VictoriaMetrics/VictoriaMetrics >= 1.0.0, < 1.110.23`

## Remediation

Upgrade to a patched release:

- `github.com/VictoriaMetrics/VictoriaMetrics 1.129.1`
- `github.com/VictoriaMetrics/VictoriaMetrics 1.122.8`
- `github.com/VictoriaMetrics/VictoriaMetrics 1.110.23`