What is the CVSS score of CVE-2025-61258?

CVE-2025-61258 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of OutSystems Platform Server are affected by CVE-2025-61258?

OutSystems Platform Server version 11.18.1.37828 is reported to contain a denial-of-service vulnerability with no public exploit identified at time of analysis; however, the vendor's inability to…

Is there a public PoC exploit available for CVE-2025-61258?

Yes, a public proof-of-concept exploit is available for CVE-2025-61258. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-61258?

Within 24 hours, confirm whether your organization runs OutSystems Platform Server 11.18.1.37828 and enable monitoring for service degradation and HTTP parsing errors; contact OutSystems support for reproduction status and interim mitigations. Within 7 days, implement HTTP request validation at your load balancer or WAF to detect Content-Length header mismatches, apply rate limiting to reduce exposure from malformed requests, and review recent logs for suspicious HTTP patterns. Within 30 days, coordinate with OutSystems on an upgrade timeline to a patched version when released, and validate no exploitation has occurred through scanning and forensic analysis.

OutSystems Platform Server CVE-2025-61258

HIGH

HTTP Request/Response Smuggling (CWE-444)

2025-12-09 cve@mitre.org

Request Smuggling Denial Of Service Platform Server

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-accessible with no authentication per description; DoS-only impact scoped to availability with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 24, 2026 - 14:36 vuln.today

CVE Published

Dec 09, 2025 - 18:15 cve.org

HIGH 7.5

DescriptionCVE.org

Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the body length. NOTE: the Supplier indicates that they are unable to reproduce this.

AnalysisAI

OutSystems Platform Server version 11.18.1.37828 is reported to allow denial of service through HTTP request smuggling (CWE-444) by sending a crafted HTTP request where the Content-Length header value does not match the actual body length, disrupting the server's HTTP parser and causing service unavailability. The impact is limited to availability - no confidentiality or integrity exposure is indicated. Critically, the vendor has publicly stated they are unable to reproduce this vulnerability, and the PoC references point exclusively to personal blogs rather than established security research publications, introducing substantial uncertainty about the finding's validity. No public exploit identified at time of analysis has been confirmed by independent researchers or CISA KEV.

Technical ContextAI

OutSystems Platform Server is a low-code application development and delivery platform used in enterprise environments. CWE-444, 'Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling),' describes a root cause where front-end and back-end components disagree on HTTP message boundary parsing - typically exploited via conflicting Content-Length and Transfer-Encoding headers. In this specific report, the attack surfaces through a Content-Length value deliberately mismatched against the actual body length, which may cause the server's HTTP handling layer to stall, consume excessive resources, or fail to process subsequent requests. The affected product is precisely scoped by CPE as cpe:2.3:a:outsystems:platform_server:11.18.1.37828, indicating a single, pinpoint version rather than a broad release family.

RemediationAI

No vendor-released patch has been identified at time of analysis, and the OutSystems reference (https://www.outsystems.com/) does not link to a specific security bulletin acknowledging this CVE. Given the vendor's stated inability to reproduce the issue, organizations should monitor OutSystems' official security advisories for any future acknowledgment, patch release, or explicit dismissal of the finding. As a near-term compensating control, deploying a web application firewall or HTTP-aware reverse proxy configured to reject requests with malformed or mismatched Content-Length headers can reduce exposure - note this may reject certain non-standard but legitimate client behaviors and should be tested before broad deployment. Restricting inbound access to Platform Server HTTP endpoints to known IP ranges or internal networks limits the unauthenticated attack surface without requiring application changes.