{"id":"CVE-2025-11362","sourceIdentifier":"report@snyk.io","published":"2025-10-07T05:15:33.787","lastModified":"2026-10-19T16:10:00.260","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition."},{"lang":"es","value":"Las versiones del paquete pdfmake anteriores a la 0.3.0-beta.17 son vulnerables a la Asignación de Recursos Sin Límites o Limitación (Allocation of Resources Without Limits or Throttling) mediante la redirección repetida de URL en la incrustación de archivos. Un atacante puede hacer que la aplicación falle o deje de responder al proporcionar una entrada manipulada que desencadene esta condición."}],"affected":[{"source":"report@snyk.io","affectedData":[{"vendor":"n/a","product":"pdfmake","versions":[{"version":"0.3.0-beta.1","lessThan":"0.3.0-beta.17","versionType":"semver","status":"affected"}]},{"vendor":"n/a","product":"org.webjars.npm:pdfmake","versions":[{"version":"0.3.0-beta.1","lessThan":"0.3.0-beta.18","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"report@snyk.io","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"report@snyk.io","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-07T18:28:56.731902Z","id":"CVE-2025-11362","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"report@snyk.io","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta1:*:*:*:*:*:*","matchCriteriaId":"66C8AC2C-2DC7-4934-83A0-CCB117E42E30"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta10:*:*:*:*:*:*","matchCriteriaId":"6E9F434F-B222-4B9E-894F-EF27349FD85A"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta11:*:*:*:*:*:*","matchCriteriaId":"302CBC0D-4021-43C9-9214-258EFAEBADA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta12:*:*:*:*:*:*","matchCriteriaId":"813FC92B-1352-46B2-98E5-177F2774A2FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta13:*:*:*:*:*:*","matchCriteriaId":"6998E01F-28D0-4110-9B73-051917FC1786"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta14:*:*:*:*:*:*","matchCriteriaId":"3AE1D6C1-6D1F-40E2-A56B-D8975F41CF58"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta15:*:*:*:*:*:*","matchCriteriaId":"A208BAFD-8F2C-4A30-87BC-9B9A4051113F"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta16:*:*:*:*:*:*","matchCriteriaId":"3D03BA7A-C32D-4FBA-8A45-3BB1EDFAA456"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta2:*:*:*:*:*:*","matchCriteriaId":"438BF14C-6B93-4D8C-BF7E-C7BA40E04595"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta3:*:*:*:*:*:*","matchCriteriaId":"99C6EF3B-B002-4EB4-96DB-DFFFFED5570F"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta4:*:*:*:*:*:*","matchCriteriaId":"60BC0F53-38A5-4BFD-95AC-47B7635BA52E"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta5:*:*:*:*:*:*","matchCriteriaId":"5F25A975-45B3-4D96-A3DA-EF388D7C0C78"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta6:*:*:*:*:*:*","matchCriteriaId":"50BDBDEA-E9AA-4D3D-B0C1-35552D2A6FE0"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta7:*:*:*:*:*:*","matchCriteriaId":"8C08D75E-8340-4522-88C5-3871B461EA63"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta8:*:*:*:*:*:*","matchCriteriaId":"FC47E00A-8A0D-4D66-BA63-9D9400584815"},{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:0.3.0:beta9:*:*:*:*:*:*","matchCriteriaId":"76F34238-5ADD-4491-A01F-ECD62ECF10DB"}]}]}],"references":[{"url":"https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed","source":"report@snyk.io","tags":["Patch"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14101887","source":"report@snyk.io"},{"url":"https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297","source":"report@snyk.io","tags":["Third Party Advisory"]}]}