Denial of Service Vulnerability in IBM Semeru Runtime Products
CVE-2025-2900

7.5HIGH

Key Information:

Vendor

IBM
Status
Semeru Runtime
Vendor
CVE Published:
14 May 2025

What is CVE-2025-2900?

IBM Semeru Runtime is affected by a denial of service vulnerability due to a buffer overflow in its native AES/CBC encryption implementation. This flaw can lead to application crashes, significantly affecting system availability. Users of versions 8.0.302.0 through 8.0.442.0, 11.0.12.0 through 11.0.26.0, 17.0.0.0 through 17.0.14.0, and 21.0.0.0 through 12.0.6.0 should take immediate action to secure their deployments against this issue.

Affected Version(s)

Semeru Runtime 8.0.302.0 <= 8.0.442.0

Semeru Runtime 11.0.12.0 <= 11.0.26.0

Semeru Runtime 17.0.0.0 <= 17.0.14.0

References

https://www.ibm.com/support/pages/node/7233415
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-2900 : Denial of Service Vulnerability in IBM Semeru Runtime Products