CVE-2025-3986: medium-severity vulnerability in Apereo CAS
Apereo CAS CasConfigurationMetadataServerController.java redos
Published · Updated
Follow this CVE+ Monitor CAS+ Monitor org.apereo.cas:cas-server-core-configuration-metadata-repository
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.7%
A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-server-core-configuration-metadata-repository\src\main\java\org\apereo\cas\metadata\rest\CasConfigurationMetadataServerController.java. The manipulation of the argument Name leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
Apereo · CASRelated CVEs — Apereo CAS
In the same product, most dangerous first.
CVE-2024-11208MEDIUMApereo CAS login session expirationEPSS 0.8%CVE-2025-3985MEDIUMApereo CAS ResponseEntity redosEPSS 0.6%CVE-2024-11209MEDIUMApereo CAS 2FA login improper authenticationEPSS 0.6%CVE-2023-28857MEDIUMLDAP password leak in Apereo CAS - GHSL-2023-009EPSS 0.5%CVE-2025-3984LOWApereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injectionEPSS 0.5%CVE-2024-11207MEDIUMApereo CAS login redirectEPSS 0.4%