CVE-2025-27100
Last modified
CVE-2025-27100 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. EPSS estimates a 0.41% chance of exploitation in the next 30 days.
Description
lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below are affected. Users are advised to upgrade. Users unable to upgrade should either set the environment variable `LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART` to `true` or configure the `disable_pre_signed_multipart` key to true in their config yaml.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-27100?
How severe is CVE-2025-27100?
How do I fix CVE-2025-27100?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-27095JumpServer is an open source bastion host and an operation a…4.3
- CVE-2025-27096WeGIA is a Web Manager for Institutions with a focus on Port…9.8
- CVE-2025-27097GraphQL Mesh is a GraphQL Federation framework and gateway f…7.5
- CVE-2025-27098GraphQL Mesh is a GraphQL Federation framework and gateway f…7.5
- CVE-2025-27099Tuleap is an Open Source Suite to improve management of soft…4.8
- CVE-2025-2710A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and cla…6.1
- CVE-2025-27101Opal is OBiBa’s core database application for biobanks or ep…7.3
- CVE-2025-27102Agate is central authentication server software for OBiBa ep…5.4
- CVE-2025-27103DataEase is an open source business intelligence and data vi…6.5
- CVE-2025-27104vyper is a Pythonic Smart Contract Language for the EVM. Mul…7.5
- CVE-2025-27105vyper is a Pythonic Smart Contract Language for the EVM. Vyp…9.1
- CVE-2025-27106binance-trading-bot is an automated Binance trading bot with…8.8
Are you affected by CVE-2025-27100?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST