low2.7

CVE-2025-65942

VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM

Impact

### Impact Affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits. ### Patches Versions 1.129.1, 1.122.8, 1.110.23 ### Resources - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.129.1 - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.8 - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.110.23 ### Note VictoriaMetrics' security model assumes its APIs are properly secured (e.g. via access control flags or a firewall); this advisory addresses malicious input that should not be possible under a [correctly secured](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#security) deployment.

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/VictoriaMetrics/VictoriaMetrics`	>= 1.123.0, < 1.129.1	1.129.1

Affected products

Product	Affected versions
Versions From 1.0.0 To	before 1.110.23
From 1.111.0 To	before 1.122.8
And From 1.123.0 To	before 1.129.1

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

CWE-770

Impact

Affected packages

Affected products

Weakness classification

References