CVE-2025-46354 Denial of service in Comdb2
A specially crafted network packet can cause a denial of service in Bloomberg Comdb2 via its distributed transaction functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-46354?
CVE-2025-46354 is a high-severity denial of service vulnerability in Bloomberg Comdb2, published on 22 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloomberg Comdb2 8.1. A specially crafted network packet can lead to a denial of service. An attacker can send a malicious packet to trigger this vulnerability.
Weakness: CWE-617
Which versions are affected by CVE-2025-46354?
It affects 1 product.
Products include Bloomberg Comdb2.
How do I fix CVE-2025-46354?
No fix has been published for CVE-2025-46354 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-46354 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46354 exists.
Other vulnerabilities in Bloomberg Comdb2
Sources
Also known as GHSA-wmqj-mjgx-4cxm.