EUVD-2025-210861
GHSA-vv9f-xjr8-pph6
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Attacker submits the oversized input themselves, so UI:N is more accurate than vendor UI:R; all other metrics align with vendor assessment.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability.
AnalysisAI
HCL MyXalytics is susceptible to a low-severity denial-of-service condition via unrestricted character input in user-facing fields. Authenticated users can submit arbitrarily long strings into application inputs, potentially degrading system performance or availability due to absent input-length controls. No public exploit code exists and no active exploitation has been observed; the vendor CVSS score of 3.5 (Low) reflects limited real-world impact.
Technical ContextAI
HCL MyXalytics (CPE: cpe:2.3:a:hcl_software:myxalytics:*:*:*:*:*:*:*:*) is a business analytics and reporting platform developed by HCL Software. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), which arises when an application does not enforce size or rate constraints on resource-consuming inputs. In this case, text input fields accept unbounded data, and the application processes this input without truncation or rejection, which can exhaust memory, CPU, or storage resources on the server and degrade service availability. The absence of server-side input length validation is the root cause.
RemediationAI
Apply the remediation or patch described in HCL's support advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132828. A specific fixed version number is not confirmed from the available data - customers should consult HCL directly for the patched release. As a compensating control while awaiting a patch, administrators can enforce server-side input-length limits via a web application firewall (WAF) rule that rejects or truncates requests exceeding a defined payload size; this adds a processing step but eliminates the unbounded allocation risk. Additionally, restricting application access to the minimum necessary user population reduces the pool of accounts that could trigger the condition, though it does not eliminate the underlying flaw. Rate-limiting authenticated API or form endpoints is a further mitigation with negligible functional trade-off for normal users.
More in Myxalytics
View allHCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secr
Content spoofing in HCL MyXalytics (CWE-451) enables an authenticated, low-privileged attacker to inject manipulated con
Improper input validation in HCL MyXalytics allows an authenticated low-privileged user to submit malicious or unexpecte
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today