Open OnDemand Shell App closed websocket DoS

published 2025-07-11 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-21186

cvss: 5.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits: 0; none known

Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service (DoS) to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6.

Patch / fix

fixed in 1 links 2

osc open_ondemand 3.1.14, 4.0.6

github.com/OSC/ondemand@40800d6 commit
github.com/OSC/ondemand@96f29b9 commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 15 mo ago (2025-07-14)

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected products

OSC ondemand

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-779 Logging of Excessive Data

References

Sources

CVE List CVE-2025-53636
NVD CVE-2025-53636

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary