What is the CVSS score of CVE-2025-58063?

CVE-2025-58063 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.1%.

Which versions of Red Hat are affected by CVE-2025-58063?

Organizations using version 1.2.0 and face moderate risk from CVE-2025-58063 rated CVSS 7.1. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-58063?

Within 30 days: Identify all affected systems running version 1.2.0 and and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Red Hat CVE-2025-58063

HIGH

Incorrect Conversion between Numeric Types (CWE-681)

2025-09-09 security-advisories@github.com

Information Disclosure Red Hat Suse

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

SUSE

HIGH

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 19:11 vuln.today

CVE Published

Sep 09, 2025 - 20:15 nvd

HIGH 7.1

DescriptionGitHub Advisory

CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The TTL() function in plugin/etcd/etcd.go incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue.

AnalysisAI

CoreDNS is a DNS server that chains plugins. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-681. CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The TTL() function in plugin/etcd/etcd.go incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue. Version information: version 1.2.0.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Same weakness CWE-681 – Incorrect Conversion between Numeric Types

View all

CVE-2017-7308 HIGH POC

7.8

CVE-2016-3074 CRITICAL POC

9.8

CVE-2021-38187 CRITICAL POC

9.8

CVE-2022-34169 HIGH POC

7.5

CVE-2022-27882 HIGH POC

7.5

CVE-2021-27219 HIGH POC

7.5

CVE-2020-6582 HIGH POC

7.5

CVE-2019-16200 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

SUSE

Severity: High

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE	Affected
SUSE Package Hub 15 SP6	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed

CVE-2025-58063 vulnerability details – vuln.today

Back

Red Hat CVE-2025-58063

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Same weakness CWE-681 – Incorrect Conversion between Numeric Types

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code