Skip to main content

Metabase EUVDEUVD-2025-17571

| CVE-2025-5895 LOW
Uncontrolled Resource Consumption (CWE-400)
2025-06-09 cna@vuldb.com
Denial Of Service Metabase
2.1
CVSS 4.0 · NVD

Severity by source

NVD PRIMARY
2.1 LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

9
Source Code Evidence Fetched
Jul 26, 2026 - 12:39 vuln.today
Severity Changed
Apr 29, 2026 - 01:11 NVD
MEDIUM LOW
CVSS changed
Apr 29, 2026 - 01:11 NVD
4.3 (MEDIUM) 2.1 (LOW)
EUVD ID Assigned
Mar 14, 2026 - 19:21 euvd
EUVD-2025-17571
Analysis Generated
Mar 14, 2026 - 19:21 vuln.today
Patch released
Mar 14, 2026 - 19:21 nvd
Patch available
PoC Detected
Jul 10, 2025 - 16:26 vuln.today
Public exploit code
CVE Published
Jun 09, 2025 - 20:15 nvd
MEDIUM 4.3
CVE Published
Jun 09, 2025 - 20:15 cve.org
LOW 2.1

DescriptionCVE.org

A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue.

AnalysisAI

Regular expression denial of service (ReDoS) in Metabase 0.54.10 allows remote low-privileged attackers to trigger CPU exhaustion via crafted data URIs processed by the parseDataUri function. The vulnerability stems from an inefficient regex susceptible to catastrophic backtracking, leading to availability impact. Public exploit code is available, and a vendor patch has been released.

More in Metabase

View all
CVE-2026-72898 CRITICAL POC
10.0 Aug 10

SQL injection in Metabase's '/reset_password' database endpoint lets a remote, unauthenticated attacker inject arbitrary
CVE-2023-38646 CRITICAL POC
9.8 Jul 21

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
CVE-2021-41277 HIGH POC
7.5 Nov 17

Metabase is an open source data analytics platform. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2022-43776 MEDIUM POC
6.5 Oct 26

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request For
CVE-2026-72899 CRITICAL
10.0 Aug 10

SQL injection in Metabase lets an unauthenticated remote attacker execute arbitrary SQL against the connected database b
CVE-2023-37470 CRITICAL
9.8 Aug 04

Metabase is an open-source business intelligence and analytics platform. Rated critical severity (CVSS 9.8), this vulner
CVE-2023-32680 CRITICAL
9.6 May 18

Metabase is an open source business analytics engine. Rated critical severity (CVSS 9.6), this vulnerability is remotely
CVE-2022-24853 MEDIUM POC
5.3 Apr 14

Metabase is an open source business intelligence and analytics application. Rated medium severity (CVSS 5.3), this vulne
CVE-2026-50148 CRITICAL
9.1 Jul 15

Remote code execution in Metabase (open-source business intelligence platform) versions 1.54.0 through the fixed release
CVE-2026-59826 CRITICAL
9.1 Jul 09

Remote code execution in Metabase (open-source BI/analytics platform) versions 1.55.0 through the fixed releases arises

CVE-2026-59827 HIGH
8.8 Jul 09

Remote code execution in Metabase's H2 database driver allows an authenticated user with native-query privileges to run

CVE-2022-39362 HIGH
8.8 Oct 26

Metabase is data visualization software. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2025-17571 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy