VulnerabilityDeferred

CVE-2025-31990

Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks.

MEDIUM 6.8EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability is fixed in 5.1.7.

CVSS 3.1: 6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
EPSS: 0.26% probability · 18th percentile
CISA KEV: Not listed
Weakness: CWE-770
Source: psirt@hcl.com

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128585

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.