Terracotta
Monthly
Applications running affected versions of Ehcache 3.x (shipped commercially as IBM Terracotta) can have their cache-write path slowed by remote attackers who can influence the cache keys the application supplies. The issue only materializes when an application derives cache keys from external, attacker-controlled input and passes them into Ehcache in an unfiltered or unsalted form, allowing crafted keys to degrade write throughput; applications that hash, salt, validate, or internally generate their keys are not exposed. The vendor-assessed CVSS of 3.7 (AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:L) and an EPSS score of 0.21 percent (10th percentile) place this as a low-priority availability nuisance rather than a data-compromise or code-execution risk, and no public exploit identified at time of analysis.
Applications running affected versions of Ehcache 3.x (shipped commercially as IBM Terracotta) can have their cache-write path slowed by remote attackers who can influence the cache keys the application supplies. The issue only materializes when an application derives cache keys from external, attacker-controlled input and passes them into Ehcache in an unfiltered or unsalted form, allowing crafted keys to degrade write throughput; applications that hash, salt, validate, or internally generate their keys are not exposed. The vendor-assessed CVSS of 3.7 (AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:L) and an EPSS score of 0.21 percent (10th percentile) place this as a low-priority availability nuisance rather than a data-compromise or code-execution risk, and no public exploit identified at time of analysis.