CVE-2025-65519

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-65519

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65519.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-65519

Published

2026-02-18T00:00:00Z

Modified

2026-07-15T01:48:53.272360311Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing. The application fails to validate nesting depth during parsing operations, allowing authenticated attackers to trigger denial of service conditions by uploading deeply nested malicious files. This results in CPU exhaustion, service degradation, or complete service unavailability.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65519.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/mayswind/ezbookkeeping

Affected ranges

Type

GIT

Repo

https://github.com/mayswind/ezbookkeeping

Events

Introduced

Last affected

4c8bb5a0b7f5a40821fa666dc600caaccde8c1f0

Database specific

{
    "cpe": "cpe:2.3:a:mayswind:ezbookkeeping:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.2.0"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.10.0

v0.2.0

v0.3.0

v0.4.0

v0.5.0

v0.6.0

v0.7.0

v0.8.0

v0.9.0

v1.*

v1.0.0

v1.1.0

v1.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65519.json"