{"id":"CVE-2019-25072","aliases":["EUVD-2022-7486","GHSA-3fm3-m23v-5r46","GO-2020-0037","UBUNTU-CVE-2019-25072"],"status":"published","title":"Uncontrolled resource consumption in github.com/tendermint/tendermint","description":"Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0123,"percentile":0.69145,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-04-14T20:04:52Z","modified":"2026-10-20T10:52:42Z","fixes":[{"ecosystem":"Go","package":"github.com/tendermint/tendermint","fixed_in":["0.31.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/tendermint/tendermint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/tendermint/tendermint","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.31.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/tendermint/tendermint","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.31.1"}]}]}],"products":[{"vendor":"github.com/tendermint/tendermint","product":"github.com/tendermint/tendermint/rpc/lib/client"},{"vendor":"tendermint","product":"tendermint"}],"references":[{"url":"https://github.com/tendermint/tendermint/pull/3430","tags":["x_transferred","Third Party Advisory","advisory","web","fix","report"]},{"url":"https://github.com/tendermint/tendermint/commit/03085c2da23b179c4a51f59a03cb40aa4e85a613","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://pkg.go.dev/vuln/GO-2020-0037","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25072","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3fm3-m23v-5r46"},{"url":"https://github.com/tendermint/tendermint","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2019-25072","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25072","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-25072","title":"Uncontrolled resource consumption in github.com/tendermint/tendermint","description":"Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.","status":"published","published":"2022-12-27T21:13:24.222Z","modified":"2025-04-11T16:40:25.817Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:20:19.737165Z"}],"euvd":[{"id":"EUVD-2022-7486","description":"Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.","status":"published","published":"2022-12-27T21:13:24Z","modified":"2025-04-11T16:40:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:34.493984Z"}],"ghsa":[{"id":"GHSA-3fm3-m23v-5r46","title":"Tendermint Client package vulnerable to Uncontrolled Resource Consumption","description":"Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.","status":"published","published":"2022-12-28T00:30:23Z","modified":"2023-02-17T23:02:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:45.67005Z"}],"nvd":[{"id":"CVE-2019-25072","description":"Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.","status":"published","published":"2022-12-27T22:15:11.323Z","modified":"2026-06-17T02:31:36.403Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:05:49.099942Z"}],"osv":[{"id":"CVE-2019-25072","description":"Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.","status":"published","published":"2022-12-27T22:15:11.323Z","modified":"2026-10-20T10:52:42.192477219Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"GHSA-3fm3-m23v-5r46","title":"Tendermint Client package vulnerable to Uncontrolled Resource Consumption","description":"Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.","status":"published","published":"2022-12-28T00:30:23Z","modified":"2023-11-08T04:01:32.918826Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"UBUNTU-CVE-2019-25072","description":"Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.","status":"withdrawn","published":"2022-12-27T22:15:00Z","modified":"2026-02-10T06:46:08.032604Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"GO-2020-0037","title":"Uncontrolled resource consumption in github.com/tendermint/tendermint","description":"Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}