{ "document": { "aggregate_severity": { "text": "High" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/vex/2025/cve-2025-15284-els_os-almalinux9_2esu.json" } ], "tracking": { "current_release_date": "2026-04-03T16:46:33Z", "generator": { "date": "2026-04-03T16:46:33Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2025-15284-ELS_OS-ALMALINUX9.2ESU", "initial_release_date": "2025-12-29T22:56:00Z", "revision_history": [ { "date": "2025-12-29T22:56:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-04-02T08:59:51Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-04-03T16:46:33Z", "number": "3", "summary": "Update document" } ], "status": "final", "version": "3" }, "title": "Security update on CVE-2025-15284" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.2", "product": { "name": "AlmaLinux 9.2", "product_id": "AlmaLinux-9.2", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.2:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "file-devel-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product": { "name": "file-devel-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product_id": "file-devel-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/file-devel@5.39-12.1.el9_2.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "file-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product": { "name": "file-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product_id": "file-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/file@5.39-12.1.el9_2.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "file-libs-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product": { "name": "file-libs-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product_id": "file-libs-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/file-libs@5.39-12.1.el9_2.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "file-static-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product": { "name": "file-static-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product_id": "file-static-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/file-static@5.39-12.1.el9_2.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "libicu-0:67.1-9.el9.tuxcare.els1.x86_64", "product": { "name": "libicu-0:67.1-9.el9.tuxcare.els1.x86_64", "product_id": "libicu-0:67.1-9.el9.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libicu@67.1-9.el9.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64", "product": { "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64", "product_id": "libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libicu-devel@67.1-9.el9.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "icu-0:67.1-9.el9.tuxcare.els1.x86_64", "product": { "name": "icu-0:67.1-9.el9.tuxcare.els1.x86_64", "product_id": "icu-0:67.1-9.el9.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/icu@67.1-9.el9.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "file-devel-0:5.39-12.1.el9_2.tuxcare.els1.i686", "product": { "name": "file-devel-0:5.39-12.1.el9_2.tuxcare.els1.i686", "product_id": "file-devel-0:5.39-12.1.el9_2.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/file-devel@5.39-12.1.el9_2.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "file-libs-0:5.39-12.1.el9_2.tuxcare.els1.i686", "product": { "name": "file-libs-0:5.39-12.1.el9_2.tuxcare.els1.i686", "product_id": "file-libs-0:5.39-12.1.el9_2.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/file-libs@5.39-12.1.el9_2.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "libicu-0:67.1-9.el9.tuxcare.els1.i686", "product": { "name": "libicu-0:67.1-9.el9.tuxcare.els1.i686", "product_id": "libicu-0:67.1-9.el9.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libicu@67.1-9.el9.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.i686", "product": { "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.i686", "product_id": "libicu-devel-0:67.1-9.el9.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libicu-devel@67.1-9.el9.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "python3-file-magic-0:5.39-12.1.el9_2.tuxcare.els1.noarch", "product": { "name": "python3-file-magic-0:5.39-12.1.el9_2.tuxcare.els1.noarch", "product_id": "python3-file-magic-0:5.39-12.1.el9_2.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/python3-file-magic@5.39-12.1.el9_2.tuxcare.els1?arch=noarch" } } }, { "category": "product_version", "name": "libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch", "product": { "name": "libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch", "product_id": "libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libicu-doc@67.1-9.el9.tuxcare.els1?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "file-devel-0:5.39-12.1.el9_2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:file-devel-0:5.39-12.1.el9_2.tuxcare.els1.x86_64" }, "product_reference": "file-devel-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "file-devel-0:5.39-12.1.el9_2.tuxcare.els1.i686 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:file-devel-0:5.39-12.1.el9_2.tuxcare.els1.i686" }, "product_reference": "file-devel-0:5.39-12.1.el9_2.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "file-0:5.39-12.1.el9_2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:file-0:5.39-12.1.el9_2.tuxcare.els1.x86_64" }, "product_reference": "file-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "python3-file-magic-0:5.39-12.1.el9_2.tuxcare.els1.noarch as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:python3-file-magic-0:5.39-12.1.el9_2.tuxcare.els1.noarch" }, "product_reference": "python3-file-magic-0:5.39-12.1.el9_2.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "file-libs-0:5.39-12.1.el9_2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:file-libs-0:5.39-12.1.el9_2.tuxcare.els1.x86_64" }, "product_reference": "file-libs-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "file-libs-0:5.39-12.1.el9_2.tuxcare.els1.i686 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:file-libs-0:5.39-12.1.el9_2.tuxcare.els1.i686" }, "product_reference": "file-libs-0:5.39-12.1.el9_2.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "file-static-0:5.39-12.1.el9_2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:file-static-0:5.39-12.1.el9_2.tuxcare.els1.x86_64" }, "product_reference": "file-static-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "libicu-0:67.1-9.el9.tuxcare.els1.i686 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.i686" }, "product_reference": "libicu-0:67.1-9.el9.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "libicu-0:67.1-9.el9.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.x86_64" }, "product_reference": "libicu-0:67.1-9.el9.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch" }, "product_reference": "libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.i686 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.i686" }, "product_reference": "libicu-devel-0:67.1-9.el9.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64" }, "product_reference": "libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "icu-0:67.1-9.el9.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:icu-0:67.1-9.el9.tuxcare.els1.x86_64" }, "product_reference": "icu-0:67.1-9.el9.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-15284", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\nSummary\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\nDetails\nThe arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\nVulnerable code (lib/parse.js:159-162):\nif (root === '[]' && options.parseArrays) {\nobj = utils.combine([], leaf); // No arrayLimit check\n}\nWorking code (lib/parse.js:175):\nelse if (index <= options.arrayLimit) { // Limit checked here\nobj = [];\nobj[index] = leaf;\n}\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.\nPoC\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length); // Output: 6 (should be max 5)\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\nImpact\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "other", "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.", "title": "Statement" } ], "product_status": { "known_not_affected": [ "AlmaLinux-9.2:file-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:file-devel-0:5.39-12.1.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:file-devel-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:file-libs-0:5.39-12.1.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:file-libs-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:file-static-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:python3-file-magic-0:5.39-12.1.el9_2.tuxcare.els1.noarch" ], "under_investigation": [ "AlmaLinux-9.2:icu-0:67.1-9.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.i686", "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.i686", "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-15284" } ], "release_date": "2025-12-29T22:56:00Z", "remediations": [ { "category": "none_available", "details": "Affected", "product_ids": [ "AlmaLinux-9.2:icu-0:67.1-9.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.i686", "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.i686", "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.2:file-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:file-devel-0:5.39-12.1.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:file-devel-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:file-libs-0:5.39-12.1.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:file-libs-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:file-static-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:icu-0:67.1-9.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.i686", "AlmaLinux-9.2:libicu-0:67.1-9.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.i686", "AlmaLinux-9.2:libicu-devel-0:67.1-9.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:libicu-doc-0:67.1-9.el9.tuxcare.els1.noarch", "AlmaLinux-9.2:python3-file-magic-0:5.39-12.1.el9_2.tuxcare.els1.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" }, { "category": "impact", "details": "important", "product_ids": [ "AlmaLinux-9.2:file-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:file-devel-0:5.39-12.1.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:file-devel-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:file-libs-0:5.39-12.1.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:file-libs-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:file-static-0:5.39-12.1.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:python3-file-magic-0:5.39-12.1.el9_2.tuxcare.els1.noarch" ] } ] } ] }