Skip to content
OpenAdvisories
Low · 2.7 CVE-2025-65942 EUVD-2025-199645GHSA-66jq-2c23-2xh5GO-2025-4161

VictoriaMetrics Snappy Decoder DoS Vulnerability is Causing OOM

Published Nov 25, 2025 · Updated Nov 26, 2025 · Assigned by GitHub_M

Description

VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits. This issue has been patched in versions 1.110.23, 1.122.8, and 1.129.1.

Affected products

VendorProductAffectedFixed
VictoriaMetrics VictoriaMetrics >= 1.0.0, < 1.110.23, >= 1.111.0, < 1.122.8, >= 1.123.0, < 1.129.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20251230T014957-150000.1.134.1 SUSE-SU-2026:0037-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/VictoriaMetrics/VictoriaMetrics >= 1.123.0, < 1.129.1 1.129.1 GHSA-66jq-2c23-2xh5
Go github.com/VictoriaMetrics/VictoriaMetrics >= 1.111.0, < 1.122.8 1.122.8 GHSA-66jq-2c23-2xh5
Go github.com/VictoriaMetrics/VictoriaMetrics >= 1.0.0, < 1.110.23 1.110.23 GHSA-66jq-2c23-2xh5
Go github.com/VictoriaMetrics/VictoriaMetrics < 1.110.23 · >= 1.111.0, < 1.122.8 · >= 1.123.0, < 1.129.1 1.110.23, 1.122.8, 1.129.1 GO-2025-4161

Advisories 2

References