OutSystems Platform Server CVE-2025-61258

The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication is required and the attack can be initiated remotely over a network with low complexity - network reachability to the Platform Server HTTP listener is the sole stated prerequisite. No specific non-default configuration, enabled feature flag, or particular deployment topology is identified as a prerequisite in the description. However, the most significant limiting factor is the vendor's explicit statement that they cannot reproduce this vulnerability, suggesting that undisclosed environmental conditions, specific middleware arrangements, or deployment configurations may be required that are absent from default installations. This unresolved discrepancy between the reporter's claims and vendor reproduction means exploitation conditions cannot be fully confirmed from available data.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a network-accessible, unauthenticated, low-complexity denial-of-service vector - a profile that would typically warrant prompt attention. However, multiple signals substantially temper this rating. The vendor (OutSystems) has explicitly stated inability to reproduce the vulnerability, which is an unusual and significant qualifier that reduces confidence in the finding's reliability across real deployments. No EPSS score was provided, preventing probabilistic exploitation likelihood estimates. This CVE does not appear in the CISA KEV catalog. The claimed PoC resides at balwurk.github.io and a companion Neocities page - personal hosting infrastructure rather than vetted security research venues - and has not been independently corroborated. The purely availability-focused impact (C:N/I:N/A:H) limits the blast radius compared to RCE or data-exfiltration classes. In aggregate, despite the elevated CVSS score, the real-world risk is likely lower than the score implies, and triaging teams should weigh the vendor's non-reproduction statement heavily until independent confirmation emerges.

An unauthenticated remote attacker sends an HTTP request directly to the OutSystems Platform Server listener with a Content-Length header value set to a number inconsistent with the actual body payload size. The server's HTTP parser, encountering the mismatch, may enter a resource-consuming or stalled state, degrading or denying service to legitimate users. A claimed PoC is hosted at balwurk.github.io/CVE-2025-61258/, though the vendor's inability to reproduce the behavior suggests environmental or version-specific conditions may be required that are not yet publicly documented.