~ / search / GHSA-66jq-2c23-2xh5

GHSA-66jq-2c23-2xh5

VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM

Source: GitHub Advisory Database (reviewed) Low CVE-2025-65942

Packages

EcosystemPackageAffectedFixed in
Go github.com/VictoriaMetrics/VictoriaMetrics >= 1.123.0, < 1.129.1 1.129.1
Go github.com/VictoriaMetrics/VictoriaMetrics >= 1.111.0, < 1.122.8 1.122.8
Go github.com/VictoriaMetrics/VictoriaMetrics >= 1.0.0, < 1.110.23 1.110.23

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits. ### Patches Versions 1.129.1, 1.122.8, 1.110.23 ### Resources - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.129.1 - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.8 - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.110.23 ### Note VictoriaMetrics' security model assumes its APIs are properly secured (e.g. via access control flags or a firewall); this advisory addresses malicious input that should not be possible under a [correctly secured](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#security) deployment.

References

External links from the advisory. They lead to third-party sites.