IBM DOORS Next CVE-2025-33096

Exploitation requires an authenticated user (CVSS PR:L) with access to the DOORS Next file-upload functionality, who then submits a specially crafted file whose nested structure drives uncontrolled recursion (CWE-674) during server-side parsing. Affected deployments are IBM Engineering Requirements Management DOORS Next versions 7.0.2, 7.0.3, and 7.1. The principal limiting factor is the authentication requirement: an attacker must possess valid credentials or an account on the target instance, so purely external unauthenticated attackers cannot trigger it; no additional non-default configuration is indicated as necessary beyond standard upload capability.

This is a moderate-severity availability-only flaw that is unlikely to be a top patching priority outside of environments where DOORS Next uptime is business-critical. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) indicates a network-reachable, low-complexity attack requiring low-level authentication (PR:L) and no user interaction, with impact confined entirely to availability (C:N/I:N/A:H) - consistent with a CWE-674 uncontrolled-recursion denial of service rather than code execution or data exposure. Exploitation signals are weak and mutually reinforcing: EPSS is low at 0.31% (21st percentile), the CVE is NOT on CISA KEV, and no public exploit code is identified, so there is no public exploit identified at time of analysis. The main caveat is that PR:L means an attacker must already hold a valid (even low-privilege) DOORS Next account, which substantially limits the realistic threat population to insiders or attackers with stolen/registered credentials; this tension between the network vector and the authentication requirement is the key factor that lowers real-world risk below what the 6.5 score alone might suggest. No signals conflict with one another here - all available data points to a genuine but non-urgent, authenticated, availability-only issue.

An attacker holding a low-privilege but valid DOORS Next account authenticates to the web application and uploads a specially crafted file whose structure triggers unbounded recursive parsing. The deeply nested input exhausts stack or CPU/memory resources, crashing or hanging the service and denying access to legitimate requirements-management users. No public proof-of-concept is known, and no privilege escalation or data compromise results - impact is limited to service availability.