CVE-2025-1695

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an increase in CPU resource utilization. This vulnerability allows a remote attacker to cause a degradation that can lead to a limited denial-of-service (DoS). There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-835

Affected software

No affected versions have been published.

Timeline

Published: Mar 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-16965.2A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information vi CVE-2025-16977.8A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior CVE-2025-16982.8Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker to cause a denial o CVE-2025-16992.8An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access.CVE-2025-17007.0A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local atta CVE-2025-17018.9CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially CVE-2025-17027.5The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v CVE-2025-17036.4The Ultimate Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and CVE-2025-17046.5ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access t CVE-2025-17056.1The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due CVE-2025-17067.5Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.CVE-2025-17078.8The Review Schema plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.4 via post meta. This