CVE-2025-2529
IBM Terracotta denial of service
- Published
- Updated
- Reserved
- Assigned by
- ibm
Description
Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from (malicious) external parties in an unfiltered/unsalted way.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ibmCNA (assigner) | 3.1 | Low2.9 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVDNVD · Analyzed | 3.1 | Low3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.9.
Weakness
Affected products
- affected 10.15.0 – ≤ 10.15.0 IF23
- affected 11.1.0 – ≤ 11.1.0 IF5
What to do
Solution: IBM strongly recommends addressing the low severity vulnerability now by applying the mentioned fixes or later fixes for the affected versions and following the respective readme document. IBM Terracotta 11.1.0 Fix 6 or later IBM Terracotta 10.15.0 Fix 24 or later Fixes can be downloaded and installed via IBM webMethods Update Manager. Refer to How to Download webMethods Software ( https://www.ibm.com/support/pages/node/7232491 )
References (1)
- https://www.ibm.com/support/pages/node/7247977 (opens in a new tab)vendor-advisorypatch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-2529)Record last updated .