Denial of Service (DoS)

published 2022-09-08 4 y ago modified 2026-06-17 4 mo ago also GHSA-fph9-f5r6-vhqf , EUVD-2022-6805

cvss: 5.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits: 0; none known

The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.

Patch / fix

fixed in 2 links 3

maven org.eclipse.milo:sdk-server 0.6.8
n/a org.eclipse.milo:sdk-server 0.6.8

github.com/eclipse/milo@4534381 commit
github.com/eclipse/milo#1031 pull request
github.com/eclipse/milo/issues/1030 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-25897 updated 2026-11-05 cvss 7.5

sdk-server: Denial of Service

Red Hat Fuse 7 org.eclipse.milo-sdk-serve org.eclipse.milo-sdk-serve
affected: no fix planned “Will not fix”
Red Hat RHINT Camel-Springboot 3.18.3
fixed: vendor fix RHSA-2022:8902
Red Hat Integration Camel K 1 org.eclipse.milo-sdk-server org.eclipse.milo-sdk-server Red Hat Integration Camel Quarkus 1 org.eclipse.milo-sdk-server org.eclipse.milo-sdk-server
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.31% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
CNA	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.eclipse.milo:sdk-server	<0.6.8	0.6.8

Affected products

n/a org.eclipse.milo:sdk-server

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling

References

github.com /eclipse/milo/pull/1031
web, patch, third-party-advisory
github.com /eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5
web, patch, third-party-advisory
github.com /eclipse/milo/issues/1030
web, issue-tracking, patch, third-party-advisory
security.snyk.io /vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191
web, third-party-advisory
github.com /eclipse/milo/security/advisories/GHSA-fph9-f5r6-vhqf
web
nvd.nist.gov /vuln/detail/CVE-2022-25897
advisory
github.com /eclipse/milo
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary