GHSA-cgxm-vr2f-668: Parse Server Denial of Service via Nested Query Operators (CVE-2025-57480)

Vulnerability Overview Vulnerability Name: Denial of service via exponential-time processing of deeply nested query operators Vulnerability ID: GHSA-cgxm-vr2f-668 Severity: High (8.7/10) Release Date: 3 weeks ago Scope of Impact Affected Versions: - >= 9.0.0, < 9.9.1-alpha.12 - < 8.6.82 Vulnerability Type: Denial of Service (DoS) Attack Vector: Network Attack Complexity: Low Attack Requirements: None Privilege Requirements: None User Interaction: None Remediation Patch Versions: - 9.9.1-alpha.12 - 8.6.82 Patch Details: - The internal query traversal helper previously performed recursive traversal of nested arrays, leading to exponential-time processing of nested queries. - This has now been corrected to perform linear-time query traversal. - The optional parameter restriction was generalized to count nesting of logical operators, even when they are wrapped in field operators (e.g., , ) or scheduled field names, closing the bypass loophole against the REST API and LiveQuery restrictions. Additional Information CVSS v4 Base Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privilege Requirements: None - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: High - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID: CVE-2025-57480 Weakness: CWE-407 Reference Links: - GitHub Security Advisory - Fix for Parse Server 9 - Fix for Parse Server 8 Notes Workarounds: - There is no complete configuration workaround for the affected versions. - Setting to a small positive integer can reduce exposure but cannot fully prevent the issue, as the restriction can be bypassed by nesting operators within field operators. - Upgrading is strongly recommended.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-cgxm-vr2f-668: Parse Server Denial of Service via Nested Query Operators (CVE-2025-57480)

More from this source