What’s Vulnerable › Vulnerabilities

CVE-2022-25897: Denial of Service (DoS)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-08 · updated 2026-06-17
• Weakness: CWE-770

Description

The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.

Affected products

• Eclipse Foundation Eclipse Milo: before 0.6.8 — fixed in 0.6.8

How to fix

Upgrade to a fixed version: Eclipse Foundation Eclipse Milo 0.6.8. Check the vendor advisory for mitigations.

References

• https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5
• https://github.com/eclipse/milo/issues/1030
• https://github.com/eclipse/milo/pull/1031
• https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191
• https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5
• https://github.com/eclipse/milo/issues/1030
• https://github.com/eclipse/milo/pull/1031
• https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191

Get alerted when CVE-2022-25897 or the next vulnerability affects your stack