Skip to main content

spdlog CVE-2025-6140

| EUVDEUVD-2025-18431 LOW
Uncontrolled Resource Consumption (CWE-400)
2025-06-16 cna@vuldb.com
Denial Of Service Spdlog
1.9
CVSS 4.0 · NVD

Severity by source

NVD PRIMARY
1.9 LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local attack, low privileges, no user interaction, only availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Ubuntu
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

8
Source Code Evidence Fetched
Jul 26, 2026 - 13:26 vuln.today
CVSS changed
Apr 29, 2026 - 01:11 NVD
3.3 (LOW) 1.9 (LOW)
EUVD ID Assigned
Mar 14, 2026 - 21:59 euvd
EUVD-2025-18431
Analysis Generated
Mar 14, 2026 - 21:59 vuln.today
Patch released
Mar 14, 2026 - 21:59 nvd
Patch available
PoC Detected
Jul 02, 2025 - 18:58 vuln.today
Public exploit code
CVE Published
Jun 16, 2025 - 22:16 nvd
LOW 3.3
CVE Published
Jun 16, 2025 - 22:16 cve.org
LOW 1.9

DescriptionCVE.org

A vulnerability, which was classified as problematic, was found in spdlog up to 1.15.1. This affects the function scoped_padder in the library include/spdlog/pattern_formatter-inl.h. The manipulation leads to resource consumption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.2 is able to address this issue. The identifier of the patch is 10320184df1eb4638e253a34b1eb44ce78954094. It is recommended to upgrade the affected component.

AnalysisAI

Denial of service in spdlog up to 1.15.1 via the scoped_padder function in pattern_formatter-inl.h allows local attackers to cause resource consumption. Public exploit code exists, but EPSS score is low (0.05%) and no active exploitation in CISA KEV.

Technical ContextAI

spdlog is a fast C++ logging library. The vulnerability is a CWE-400 (Uncontrolled Resource Consumption) in the scoped_padder helper used for formatting log patterns. The issue involves improper handling of negative size values, leading to excessive memory or CPU usage. CPE data confirms all versions up to 1.15.1 are affected.

RemediationAI

Upgrade to spdlog version 1.15.2, which contains the fix commit 10320184df1eb4638e253a34b1eb44ce78954094. No workarounds are documented; as a local low-privilege issue, restricting local access or monitoring resource usage may mitigate impact.

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
spdlog
Release Status Version
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
jammy needs-triage -
noble needs-triage -
upstream released 1:1.15.2+ds-1
plucky ignored end of life, was needs-triage
oracular ignored end of life, was needs-triage
questing not-affected 1:1.15.3+ds-1

Debian

spdlog
Release Status Fixed Version Urgency
bullseye vulnerable 1:1.8.1+ds-2.1 -
bookworm vulnerable 1:1.10.0+ds-0.4 -
trixie fixed 1:1.15.2+ds-2 -
forky, sid fixed 1:1.15.3+ds-1 -
(unstable) fixed 1:1.15.2+ds-1 -

Share

CVE-2025-6140 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy