CVE-2025-66473

HIGH

XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the nu...

Affects 1 product across 1 vendor.

CVSS 3.17.5
CVSS v48.7
EPSS0.4%
Percentile33th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-770: Allocation of Resources Without Limits or Throttling

Software allocates resources without imposing limits, allowing attackers to exhaust system capacity.

Related Attack Patterns (CAPEC)
CAPEC-147 XML Ping of the Death
via CWE-770
CAPEC-197 Exponential Data Expansion
via CWE-770
CAPEC-229 Serialized Data Parameter Blowup
via CWE-770
CAPEC-491 Quadratic Data Expansion
via CWE-770
CAPEC-230 Serialized Data with Nested Payloads
via CWE-770
Show all 20

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

XWiki versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3, and 17.5.0-rc-1 through 17.6.0 are vulnerable to a denial-of-service attack due to an unbounded number of items that can be requested via the REST API, potentially leading to slowness and unavailability of the wiki.

BSID: BS-2025-GLOBAL-028822-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-66473?
XWiki versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3, and 17.5.0-rc-1 through 17.6.0 are vulnerable to a denial-of-service attack due to an unbounded number of items that can be requested via the REST API, potentially leading to slowness and unavailability of the wiki.
What is the CVSS score for CVE-2025-66473?
CVE-2025-66473 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS: 0.4%.
Is CVE-2025-66473 actively exploited?
No confirmed active exploitation of CVE-2025-66473 as of 2026-05-30.
How do I remediate CVE-2025-66473?
Priority: HIGH. Advisory: https://jira.xwiki.org/browse/XWIKI-23355 PSIRT: [email protected]
What systems are affected by CVE-2025-66473?
CVE-2025-66473 affects Xwiki Xwiki.
Vulnerability Details
CVE IDCVE-2025-66473
BSIDBS-2025-GLOBAL-028822-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published2025-12-10
Last Modified2025-12-19
ICS Relevance15%
Weakness (CWE)
Allocation of Resources Without Limits or Throttling
SourceNVD
Official Description

XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the /rest/wikis/xwiki/spaces resource returns all spaces on the wiki by default, which are basically all pages. This issue is fixed in versions 17.4.4 and 16.10.11.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending a request to the REST API with a very large number of items, causing the server to consume excessive memory and resources, leading to a denial of service.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Xwiki Xwiki < 16.10.11 ≥ 17.0.0, < 17.4.4 ≥ 17.5.0, ≤ 17.6.0
Remediation
View Vendor Advisory →

Remediation Priority: HIGH

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 309 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash36580e781b19700211a174f5fc7cca78ef21268d1ce2deb308a3a90f0449c6557a0e55045e641c01896b521ca7e1ca8411c518ead34b530f0a28ee9306c1cea4
Related CVEs affecting Xwiki
CVE-2025-55729 10.0 XWiki Remote Macros provides XWiki rendering macros that are useful when migr... CVE-2025-65091 10.0 XWiki Full Calendar Macro displays objects from the wiki on the calendar. Pri... CVE-2025-55730 10.0 XWiki Remote Macros provides XWiki rendering macros that are useful when migr... CVE-2023-27479 9.9 XWiki Platform is a generic wiki platform offering runtime services for appli... CVE-2023-26055 9.9 XWiki Commons are technical libraries common to several other top level XWiki...
View all Xwiki CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →