CVE-2025-3986: apereo cas Uncontrolled Resource Consumption
Vulnerability summary
CVE-2025-3986 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in apereo cas. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 27-04-2025PublishedVulnerability first disclosed.
- 28-04-2025Last modifiedVulnerability information updated.
Description
A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-server-core-configuration-metadata-repository\src\main\java\org\apereo\cas\metadata\rest\CasConfigurationMetadataServerController.java. The manipulation of the argument Name leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS metrics
9 scores · 3 sources · 4 versions- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVE.orgCNA4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · MavenEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- NVDNIST4.0MediumAV:N/AC:L/Au:S/C:N/I:N/A:P
EPSS trend
Probability
0.64%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
+0.04 pp
From 0.60% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wx.mail.qq.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected systems
Apereo2 products
- cas5.2.6
- central_authentication_service5.2.6
Org.apereo.cas1 product
- cas-server-core-configuration-metadata-repository≤ 5.2.6
2 vendors · 3 products
References
6 links
- github.com/apereo/casPACKAGE