CVE-2025-27100
An authenticated user can crash lakeFS by exhausting server memory
lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below are affected. Users are advised to upgrade. Users unable to upgrade should either set the environment variable LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART to true or configure the disable_pre_signed_multipart key to true in their config yaml.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An authenticated user can crash lakeFS by exhausting server memory
lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below are affected. Users are advised to upgrade. Users unable to upgrade should either set the environment variable LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART to true or configure the disable_pre_signed_multipart key to true in their config yaml.
- Record
CVE-2025-27100- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-4472
lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below are affected. Users are advised to upgrade. Users unable to upgrade should either set the environment variable LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART to true or configure the disable_pre_signed_multipart key to true in their config yaml.
- Record
EUVD-2025-4472- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j7jw-28jm-whr6
lakeFS allows an authenticated user to cause a crash by exhausting server memory
Impact
An authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue.
Patches
This problem has been patched and exists in versions 1.49.1 and below
Workarounds
On S3 backends, configure
# ...
blockstore:
s3:
disable_pre_signed_multipart: true
or set environment variable LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART to true.
References
Are there any links users can visit to find out more?
- Record
GHSA-j7jw-28jm-whr6- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below are affected. Users are advised to upgrade. Users unable to upgrade should either set the environment variable LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART to true or configure the disable_pre_signed_multipart key to true in their config yaml.
- Record
CVE-2025-27100- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
An authenticated user can crash lakeFS by exhausting server memory
lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below are affected. Users are advised to upgrade. Users unable to upgrade should either set the environment variable LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART to true or configure the disable_pre_signed_multipart key to true in their config yaml.
- Record
CVE-2025-27100- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-j7jw-28jm-whr6
lakeFS allows an authenticated user to cause a crash by exhausting server memory
Impact
An authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue.
Patches
This problem has been patched and exists in versions 1.49.1 and below
Workarounds
On S3 backends, configure
# ...
blockstore:
s3:
disable_pre_signed_multipart: true
or set environment variable LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART to true.
References
Are there any links users can visit to find out more?
- Record
GHSA-j7jw-28jm-whr6- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGO-2025-3479 No score
lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs
lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs
- Record
GO-2025-3479- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14889-1 No score
govulncheck-vulndb-0.0.20250312T181707-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250312T181707-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14889-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/treeverse/lakefsGo |
before 1.50.0 | 1.50.0 |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 31 CVEs |
before 0.0.20250312T181707-1.1 | 0.0.20250312T181707-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-27100 is a medium vulnerability (CVSS 6.5) in Treeverse Lakefs, published February 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in github.com/treeverse/lakefs 1.50.0.
References
github.com/treeverse/lakeFS/security/advisories/GHSA-j7jw-28jm-whr6
nvd.nist.gov/vuln/detail/CVE-2025-27100
Show 31 moreShow less
suse.com/security/cve/CVE-2024-57603