CVE-2025-53057
published 2025-10-21CVE-2025-53057: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported…
PriorityP335medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
EPSS
0.50%
39.4th percentile
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openjdk-11 | < openjdk-11 11.0.29+6-1~deb11u1 (bullseye) | openjdk-11 11.0.29+6-1~deb11u1 (bullseye) |
| debian | openjdk-17 | < openjdk-11 11.0.29+6-1~deb11u1 (bullseye) | openjdk-11 11.0.29+6-1~deb11u1 (bullseye) |
| debian | openjdk-21 | < openjdk-11 11.0.29+6-1~deb11u1 (bullseye) | openjdk-11 11.0.29+6-1~deb11u1 (bullseye) |
| debian | openjdk-25 | < openjdk-11 11.0.29+6-1~deb11u1 (bullseye) | openjdk-11 11.0.29+6-1~deb11u1 (bullseye) |
| debian | openjdk-8 | < openjdk-11 11.0.29+6-1~deb11u1 (bullseye) | openjdk-11 11.0.29+6-1~deb11u1 (bullseye) |
| msrc | azl3_kernel_6.6.57.1-7_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.64.2-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kernel_5.15.167.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.173.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| oracle | graalvm | — | — |
| oracle | graalvm_for_jdk | — | — |
| oracle | graalvm_for_jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle_corporation | oracle_graalvm_enterprise_edition | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
osv5.9MEDIUM
vendor_msrc7.8HIGH
vendor_debian5.9MEDIUM
vendor_oracle5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
openjdk-21-crac vulnerabilities
osv·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-21-crac vulnerabilities
openjdk-21-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks. An unauthenticated remote
attacker could possibly use this
OSV
openjdk-17-crac vulnerabilities
osv·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-17-crac vulnerabilities
openjdk-17-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 17 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 17 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-10-21
OSV
openjdk-25-crac vulnerabilities
osv·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-25-crac vulnerabilities
openjdk-25-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK
25 contained an issue where certain Strings built with StringBuilder
returned an incorrect result for String.equals() checks. An unauthenticated
remote attacker could possibly use this
OSV
openjdk-8 vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-8 vulnerabilities
openjdk-8 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 8 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 8 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-10-21
OSV
openjdk-17 vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-17 vulnerabilities
openjdk-17 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 17 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 17 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-10-21
OSV
openjdk-21 vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-21 vulnerabilities
openjdk-21 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks. An unauthenticated remote
attacker could possibly use this issue t
OSV
openjdk-lts vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-lts vulnerabilities
openjdk-lts vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 11 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 11 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-10-21
OSV
openjdk-25 vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-25 vulnerabilities
openjdk-25 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks. An unauthenticated remote
attacker could possibly use this issue t
OSV
CVE-2025-53057: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
osv·2025-10-21·CVSS 5.9
CVE-2025-53057 [MEDIUM] CVE-2025-53057: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploi
GHSA
GHSA-5ccw-23gm-2h2f: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
ghsa_unreviewed·2025-10-21
CVE-2025-53057 [MEDIUM] CWE-284 GHSA-5ccw-23gm-2h2f: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploi
Ubuntu
CRaC JDK 25 vulnerabilities
vendor_ubuntu·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] CRaC JDK 25 vulnerabilities
Title: CRaC JDK 25 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 25.
Jinfeng Guo discovered that the Security component of CRaC JDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK
25 contained an issue where certain Strings built with StringBuilder
returned an incorrect result for String.equals() ch
Ubuntu
CRaC JDK 21 vulnerabilities
vendor_ubuntu·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] CRaC JDK 21 vulnerabilities
Title: CRaC JDK 21 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 21.
Jinfeng Guo discovered that the Security component of CRaC JDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() ch
Ubuntu
CRaC JDK 17 vulnerabilities
vendor_ubuntu·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] CRaC JDK 17 vulnerabilities
Title: CRaC JDK 17 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 17.
Jinfeng Guo discovered that the Security component of CRaC JDK 17 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 17 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/gro
Ubuntu
OpenJDK 11 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 11 vulnerabilities
Title: OpenJDK 11 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 11.
Jinfeng Guo discovered that the Security component of OpenJDK 11 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 11 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/
Ubuntu
OpenJDK 17 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 17 vulnerabilities
Title: OpenJDK 17 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 17.
Jinfeng Guo discovered that the Security component of OpenJDK 17 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 17 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/
Ubuntu
OpenJDK 21 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 21 vulnerabilities
Title: OpenJDK 21 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 21.
Jinfeng Guo discovered that the Security component of OpenJDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks.
Ubuntu
OpenJDK 25 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 25 vulnerabilities
Title: OpenJDK 25 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 25.
Jinfeng Guo discovered that the Security component of OpenJDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks.
Ubuntu
OpenJDK 8 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 8 vulnerabilities
Title: OpenJDK 8 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 8.
Jinfeng Guo discovered that the Security component of OpenJDK 8 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 8 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vuln
Red Hat
openjdk: Enhance certificate handling (Oracle CPU 2025-10)
vendor_redhat·2025-10-21·CVSS 5.9
CVE-2025-53057 [MEDIUM] CWE-838 openjdk: Enhance certificate handling (Oracle CPU 2025-10)
openjdk: Enhance certificate handling (Oracle CPU 2025-10)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi
Oracle
Oracle Oracle Java SE Risk Matrix: Security — CVE-2025-53057
vendor_oracle·2025-10-15·CVSS 5.9
CVE-2025-53057 [MEDIUM] Oracle Oracle Java SE Risk Matrix: Security — CVE-2025-53057
Oracle Oracle Java SE Risk Matrix: Security vulnerability
CVE: CVE-2025-53057
CVSS: 5.9
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2025 (OCT 2025)
Debian
CVE-2025-53057: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
vendor_debian·2025·CVSS 5.9
CVE-2025-53057 [MEDIUM] CVE-2025-53057: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploi
Microsoft
net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
vendor_msrc·2024-11-12·CVSS 7.8
CVE-2024-53057 [HIGH] CWE-416 net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-21
Published