CVE-2025-25566 Denial of service in n/a
An attacker can cause a denial of service in SoftEtherVPN via a memory leak in the UnixMemoryAlloc function, though the impact is disputed as minor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-25566?
CVE-2025-25566 is a medium-severity denial of service vulnerability in n/a, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Memory Leak vulnerability in SoftEtherVPN 5.02.5187 allows an attacker to cause a denial of service via the UnixMemoryAlloc function. NOTE: the Supplier disputes this because the behavior is limited to a single allocation of a few hundred bytes with a command-line tool.
Weakness: CWE-401
Which versions are affected by CVE-2025-25566?
It affects 1 product.
Products include Softether Vpn.
How do I fix CVE-2025-25566?
No fix has been published for CVE-2025-25566 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-25566 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25566 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8hg9-rcgr-qwwm.