CVE-2025-65942 VictoriaMetrics Snappy Decoder DoS Vulnerability is Causing OOM
Attackers can cause denial of service via OOM errors by sending malformed blocks that bypass size limits in VictoriaMetrics.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-65942?
CVE-2025-65942 is a low-severity denial of service vulnerability in VictoriaMetrics, published on 25 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits. This issue has been patched in versions 1.110.23, 1.122.8, and 1.129.1.
Weakness: CWE-770
Which versions are affected by CVE-2025-65942?
7 open source packages ship an affected version, including github.com/VictoriaMetrics/VictoriaMetrics.
| Package | Affected | Fixed in |
|---|---|---|
github.com/VictoriaMetrics/VictoriaMetrics Go | All versions | 1.110.23, 1.122.8, 1.129.1 |
github.com/VictoriaMetrics/VictoriaMetrics Go | From 1.0.0 | 1.110.23 |
github.com/VictoriaMetrics/VictoriaMetrics Go | From 1.0.0 | 1.110.23 |
github.com/VictoriaMetrics/VictoriaMetrics Go | From 1.111.0 | 1.122.8 |
github.com/VictoriaMetrics/VictoriaMetrics Go | From 1.111.0 | 1.122.8 |
github.com/VictoriaMetrics/VictoriaMetrics Go | From 1.123.0 | 1.129.1 |
1 more packages
github.com/VictoriaMetrics/VictoriaMetrics Go | From 1.123.0 | 1.129.1 |
How do I fix CVE-2025-65942?
Upgrade github.com/VictoriaMetrics/VictoriaMetrics to a fixed version for your release line: 1.110.23, 1.122.8 or 1.129.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-65942 being exploited?
There is no known exploitation of CVE-2025-65942 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-QK91843, GHSA-66jq-2c23-2xh5, GO-2025-4161, MINI-474w-2gpx-vh35, MINI-6rqq-344m-h58p, MINI-964w-cm2j-2wpj and 3 more.