Ash Framework CVE-2025-62760 Unauthenticated DoS via super-linear Base64 decoding

Vulnerability Key Information Summary Vulnerability Overview Title: Unauthenticated Denial of Service (DoS) — Super-linear decoding of base64 during API key login CVE ID: CVE-2025-62760 CVSS v3.1 Score: 7.5/10 (High) Root Cause: The decoder ( and ) exhibits super-linear complexity (approx. O(n^2.6)) relative to input length and is triggerable without any credentials. An attacker can send an excessively long forged API key to exhaust server CPU before key lookup/guard checks are performed. Affected Scope Affected Versions: Fixed Version: Affected Configuration: When API key policy is enabled (opt-in, but the default documented policy) Impact: - Saturation (~175% CPU) can be achieved with approximately 16 req/s on a 10-core host - 5ms of header processing on a 10-core VM can cause scheduler starvation (756 processes, 21 minutes) - Minimal memory impact (12 MB transient allocation, 25,000 character decoding) - Primary impact: CPU exhaustion, rather than memory exhaustion Remediation Core Fix: Implement boundary checks on both attacker-controllable sinks before decoding, and remove the dependency on . POC / Fix Code (from ): Key Changes: 1. guards: and , truncating overly long inputs before decoding 2. Removed the call to , replacing it with direct usage, eliminating the most time-consuming path 3. Concurrently fixed a correctness defect: strings with non-canonical encodings were previously accepted by both decoders, resulting in multiple spellings for the same API key; the fix now accepts only the canonical form Mitigations (Operational): Set the API key length limit to 80 characters, rejecting any longer inputs directly Verify if the application places API keys in the request body (custom controllers, AshAdmin, AshGraphQl, etc.) Ensure Web server header limits are set to default values

Goal Reached Thanks to every supporter — we hit 100%!

Ash Framework CVE-2025-62760 Unauthenticated DoS via super-linear Base64 decoding

More from this source