Allocation of Resources Without Limits or Throttling in axios - CVE-2025-58754

Vulnerability identifier: #VU115167

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-58754

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to allocation of resources without limits within data: URL decode. A remote attacker can cause a denial of service condition on the target system.

axios
QRadar Investigation Assistant
Astronomer with IBM
DataPower Operations Dashboard
Db2 Intelligence Center
Storage Sentinel Anomaly Scan Engine
watsonx Orchestrate Developer Edition
watsonx Code Assistant IDE Extensions
Storage Defender - Resiliency Service
Guardium Data Security Center (GDSC)
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
WatsonX BI Assistant
watsonx.data integration
Maximo Application Suite - Visual Inspection Component
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Rational Performance Tester
DevOps Test Performance
Robotic Process Automation for Cloud Pak
Business Automation Insights
Langflow Desktop
QRadar Deployment Intelligence App
QRadar Hub
User Entity Behavior Analytics
Db2 Big SQL
IBM supplied MQ Advanced container images
Voice Gateway
Netcool Operations Insight
PowerVC
Red Hat Advanced Cluster Management for Kubernetes
IBM Sterling Secure Proxy
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
IBM Spectrum Control
IBM Sterling External Authentication Server
IBM Rational Build Forge
IBM Maximo Application Suite
Jira Software Data Center
Jira Service Management Server
Jira Service Management Data Center
IBM Robotic Process Automation
IBM Automation Decision Services
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
Ansible Automation Platform
Red Hat OpenShift AI (RHOAI)
IBM MQ Operator
App Connect Enterprise Certified Container
Red Hat OpenShift GitOps
PeopleSoft Enterprise CC Common Application Objects
IBM Edge Application Manager
IBM DataPower Gateway
IBM API Connect
Jira Software Server
Event Streams
IBM InfoSphere Information Server
IBM App Connect Enterprise
IBM Security SOAR
ansible-sign (Red Hat package)
python3.11-ruamel-yaml-clib (Red Hat package)
python3.11-distlib (Red Hat package)
python3.11-subprocess-tee (Red Hat package)
python3.11-galaxy-importer (Red Hat package)
automation-controller-fapolicyd (Red Hat package)
automation-eda-controller (Red Hat package)
python3.11-pluggy (Red Hat package)
receptor (Red Hat package)
python3.11-execnet (Red Hat package)
ansible-runner (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
automation-gateway (Red Hat package)
python3.11-django-ansible-base (Red Hat package)
bindep (Red Hat package)
ansible-builder (Red Hat package)
python3.11-pytest-xdist (Red Hat package)
python3.11-django (Red Hat package)
automation-controller (Red Hat package)
automation-hub (Red Hat package)
python3.11-galaxy-ng (Red Hat package)
python3.11-typing-extensions (Red Hat package)
python3.11-pytest (Red Hat package)
python3.11-gunicorn (Red Hat package)
ansible-navigator (Red Hat package)
ansible-creator (Red Hat package)
ansible-lint (Red Hat package)
ansible-dev-tools (Red Hat package)
molecule (Red Hat package)
python3.11-ansible-compat (Red Hat package)
python3.11-pytest-ansible (Red Hat package)
python3.11-tox-ansible (Red Hat package)
ansible-dev-environment (Red Hat package)
Quay

Install updates from vendor's website.

axios - update to 1.12.0
QRadar Investigation Assistant - update to 1.2.0
Astronomer with IBM - update to 1.1.0
Voice Gateway - update to 1.0.8.28
DataPower Operations Dashboard - update to 1.0.23.3
Db2 Intelligence Center - update to 1.1.2.0
Storage Sentinel Anomaly Scan Engine - update to 1.1.12
Netcool Operations Insight - update to 1.6.15
watsonx Orchestrate Developer Edition - update to 1.13.0
watsonx Code Assistant IDE Extensions - update to 1.9.3
Red Hat OpenShift GitOps - update to 1.17.4
Storage Defender - Resiliency Service - update to 2.0.18
Red Hat Advanced Cluster Management for Kubernetes - update to 2.13.5
IBM Sterling Secure Proxy - addressed in versions 6.1.0.3, 6.2.0.3, 6.2.1.1
Guardium Data Security Center (GDSC) - update to 3.8.5
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.0
IBM Decision Optimization for Cloud Pak for Data - update to 5.2.2
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.2.2
WatsonX BI Assistant - update to 5.2.2
watsonx.data integration - update to 5.3.0
IBM Spectrum Control - update to 5.4.13.2
IBM Sterling External Authentication Server - addressed in versions 6.1.0.4, 6.1.1.1
IBM Rational Build Forge - update to 8.0.0.29
Maximo Application Suite - Visual Inspection Component - addressed in versions 8.9.15, 9.0.12, 9.1.2
Maximo Application Suite - Monitor Component - addressed in versions 8.10.26, 8.11.24, 9.0.16, 9.1.6
IBM Maximo Application Suite - addressed in versions 8.10.30, 8.11.27, 9.0.16, 9.1.5
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.21, 9.0.13, 9.1.3
IBM API Connect - update to 10.0.8.5
Jira Software Data Center - addressed in versions 10.3.13, 11.2.1, 11.3.0
Jira Software Server - addressed in versions 10.3.13, 11.2.1, 11.3.0
Jira Service Management Server - addressed in versions 10.3.13, 11.2.1
Jira Service Management Data Center - addressed in versions 10.3.13, 11.2.1
IBM DataPower Gateway - addressed in versions 10.5.0.19, 10.6.0.7, 10.6.5.0
Event Streams - update to 12.2.0
DevOps Test Performance - update to 11.0.7
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 1
IBM App Connect Enterprise - addressed in versions 12.0.12.18, 13.0.5.0
IBM Robotic Process Automation - addressed in versions 23.0.20.5, 30.0.0.2
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.5, 30.0.0.2
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Business Automation Workflow - addressed in versions 24.0.0-IF008, 24.0.1-IF006, 25.0.0-IF003
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
IBM Security SOAR - update to 51.0.7.2
ansible-sign (Red Hat package) - addressed in versions 0.1.4-1.el8ap, 0.1.4-1.el9ap
python3.11-ruamel-yaml-clib (Red Hat package) - addressed in versions 0.2.15-1.el8ap, 0.2.15-1.el9ap
python3.11-distlib (Red Hat package) - addressed in versions 0.4.0-1.el8ap, 0.4.0-1.el9ap
python3.11-subprocess-tee (Red Hat package) - addressed in versions 0.4.2-1.el8ap, 0.4.2-1.el9ap
python3.11-galaxy-importer (Red Hat package) - addressed in versions 0.4.36-2.el8ap, 0.4.36-2.el9ap
automation-controller-fapolicyd (Red Hat package) - addressed in versions 1.0-5.el8ap, 1.0-5.el9ap
automation-eda-controller (Red Hat package) - addressed in versions 1.1.14-1.el8ap, 1.1.14-1.el9ap
python3.11-pluggy (Red Hat package) - addressed in versions 1.6.0-1.el8ap, 1.6.0-1.el9ap
receptor (Red Hat package) - addressed in versions 1.6.2-1.el8ap, 1.6.2-1.el9ap
Langflow Desktop - update to 1.8.2
python3.11-execnet (Red Hat package) - addressed in versions 2.1.2-1.el8ap, 2.1.2-1.el9ap
ansible-runner (Red Hat package) - addressed in versions 2.4.2-1.el8ap, 2.4.2-1.el9ap
Ansible Automation Platform - update to 2.5
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.5-20.el8ap, 2.5-20.el9ap
automation-gateway (Red Hat package) - addressed in versions 2.5.20251210-1.el8ap, 2.5.20251210-1.el9ap
python3.11-django-ansible-base (Red Hat package) - addressed in versions 2.5.20251210-1.el8ap, 2.5.20251210-1.el9ap
bindep (Red Hat package) - addressed in versions 2.13.0-1.el8ap, 2.13.0-1.el9ap
Red Hat OpenShift AI (RHOAI) - update to 2.22.3
QRadar Deployment Intelligence App - update to 3.0.19
ansible-builder (Red Hat package) - addressed in versions 3.1.1-1.el8ap, 3.1.1-1.el9ap
IBM MQ Operator - addressed in versions 3.2.19, 3.7.2, 9.4.4.0-r3
python3.11-pytest-xdist (Red Hat package) - addressed in versions 3.8.0-1.el8ap, 3.8.0-1.el9ap
QRadar Hub - update to 3.9.0
Quay - update to 3.16.0
python3.11-django (Red Hat package) - addressed in versions 4.2.26-1.el8ap, 4.2.26-1.el9ap
automation-controller (Red Hat package) - addressed in versions 4.6.23-1.el8ap, 4.6.23-1.el9ap
automation-hub (Red Hat package) - addressed in versions 4.10.10-1.el8ap, 4.10.10-1.el9ap
python3.11-galaxy-ng (Red Hat package) - addressed in versions 4.10.10-1.el8ap, 4.10.10-1.el9ap
python3.11-typing-extensions (Red Hat package) - addressed in versions 4.15.0-1.el8ap, 4.15.0-1.el9ap
User Entity Behavior Analytics - update to 5.0.2
Db2 Big SQL - update to 8.3
python3.11-pytest (Red Hat package) - addressed in versions 9.0.1-1.el8ap, 9.0.1-1.el9ap
IBM supplied MQ Advanced container images - update to 9.4.4.0-r3
App Connect Enterprise Certified Container - update to 12.0.17
python3.11-gunicorn (Red Hat package) - addressed in versions 23.0.0-1.el8ap, 23.0.0-1.el9ap
ansible-navigator (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap
ansible-creator (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap
ansible-lint (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap
ansible-dev-tools (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap
molecule (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap
python3.11-ansible-compat (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap
python3.11-pytest-ansible (Red Hat package) - addressed in versions 25.12.0-1.el8ap, 25.12.0-1.el9ap
python3.11-tox-ansible (Red Hat package) - addressed in versions 25.12.0-1.2.el8ap, 25.12.0-1.2.el9ap
ansible-dev-environment (Red Hat package) - addressed in versions 25.12.2-1.1.el8ap, 25.12.2-1.1.el9ap

• Exploit #11943 - Axios DoS via data: URL decode (September 12, 2025)

• https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj

• Denial of service in Axios
• IBM App Connect Enterprise update for Axios
• Multiple vulnerabilities in IBM Db2 Intelligence Center
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in IBM QRadar Investigation Assistant
• IBM Maximo Application Suite - Visual Inspection Component update for Axios
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• IBM DataPower Gateway update for Axios
• Multiple vulnerabilities in IBM QRadar Hub
• IBM App Connect Enterprise Certified Container operands update for Axios
• IBM InfoSphere Information Server update for Axios
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Business Automation Insights
• IBM watsonx Code Assistant IDE Extensions update for Axios
• IBM watsonx Orchestrate Developer Edition update for Axios
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Allocation of resources without limits or throttling in IBM Security SOAR
• IBM PowerVC update for Axios
• IBM Voice Gateway update for Axios
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM API Connect
• IBM Spectrum Control update for Axios
• IBM Edge Data Collector update for axios
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM Automation Decision Services
• Multiple vulnerabilities in Red Hat OpenShift AI (RHOAI)
• Multiple vulnerabilities in Ansible Automation Platform 2.5 packages
• Multiple vulnerabilities in IBM Storage Sentinel Anomaly Scan Engine
• Jira Software Data Center and Server update for axios
• Multiple vulnerabilities in IBM WatsonX BI Assistant for CP4D
• Multiple vulnerabilities in Red Hat Quay
• IBM Maximo Application Suite - Monitor Component update for Axios
• Jira Service Management Data Center and Server update for axios
• IBM Rational Performance Tester update for Node.js
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• IBM Robotic Process Automation for Cloud Pak update for Axios
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.13
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Astronomer with IBM update for Axios
• IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component update for Axios
• IBM Db2 Big SQL on Cloud Pak for Data update for Axios
• IBM Business Automation Workflow update for Axios
• IBM Watson Discovery Cartridge update for Axios
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.17
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in IBM Rational Build Forge
• IBM DataPower Operations Dashboard update for Axios
• Multiple vulnerabilities in IBM watsonx.data integration
• IBM Langflow Desktop update for Axios
• Allocation of Resources Without Limits or Throttling in PeopleSoft Enterprise CC Common Application Objects