PT-2025-9576

CVE-2025-1695

Published

2025-03-03

Updated

2025-11-03

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions NGINX Unit versions prior to 1.34.2

Description The issue allows a remote attacker to cause a degradation that can lead to a limited denial-of-service (DoS) by sending undisclosed requests, which can lead to an infinite loop and increase CPU resource utilization. This is a data plane issue only, with no control plane exposure.

Recommendations For versions prior to 1.34.2, update to version 1.34.2 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Tan Bui

Vendors

Affected products

Weakness enumeration

CWE-835: Loop with Unreachable Exit Condition (\'Infinite Loop\')

Related identifiers

CVE-2025-1695