Skip to main content

Thorium CVE-2025-35436

MEDIUM
Uncaught Exception (CWE-248)
2025-09-17 9119a7d8-5eab-497f-8521-727c672e3725
Denial Of Service Thorium
6.9
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 19:12 vuln.today
Patch released
Mar 28, 2026 - 19:12 nvd
Patch available
CVE Published
Sep 17, 2025 - 17:15 nvd
MEDIUM 6.9

DescriptionCVE.org

CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by providing a specially crafted email address or response. Fixed in commit 6a65a27.

AnalysisAI

CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-248. CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by providing a specially crafted email address or response. Fixed in commit 6a65a27. Affected products include: Cisa Thorium.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Thorium

View all
CVE-2025-35432 MEDIUM
6.9 Sep 17

CISA Thorium does not rate limit requests to send account verification email messages. Rated medium severity (CVSS 6.9),
CVE-2025-35435 MEDIUM
5.3 Sep 17

CISA Thorium accepts a stream split size of zero then divides by this value. Rated medium severity (CVSS 5.3), this vuln
CVE-2025-35433 LOW
2.3 Sep 17

CISA Thorium does not properly invalidate previously used tokens when resetting passwords. Rated low severity (CVSS 2.3)
CVE-2025-35434 LOW
2.3 Sep 17

CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. Rated low severity (CVSS 2.3), this vu
CVE-2025-35431 MEDIUM
5.3 Sep 17

CISA Thorium does not escape user controlled strings used in LDAP queries. Rated medium severity (CVSS 5.3), this vulner
CVE-2025-35430 MEDIUM
5.3 Sep 17

CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'

Same weakness CWE-248 – Uncaught Exception

View all
CVE-2013-10065 HIGH POC
8.7
CVE-2023-0790 HIGH POC
8.8
CVE-2024-8249 HIGH POC
7.5
CVE-2024-8020 HIGH POC
7.5
CVE-2025-59538 HIGH POC
7.5
CVE-2026-34986 HIGH POC
7.5
CVE-2024-11738 HIGH POC
7.5
CVE-2024-34363 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2025-35436 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy