Security readout for executives and security teams
Plain-English summary
Skytable versions before 0.6.4 can be remotely crashed through malformed or incomplete network connection handling. An unauthenticated attacker can cause the database server to shut down, creating a denial-of-service risk for applications that depend on it.
Executive priority
Treat as high priority where Skytable supports business services or is network-reachable. The vulnerability can stop the database server without credentials, so remediation should focus on upgrading and reducing network exposure.
Technical view
The issue is an incorrect check of accept() return values in Skytable TCP, TLS, and TCP+TLS socket run loops. Instead of continuing indefinitely, the loop can exit early, shutting down the server. Impact is availability only, with CVSS 7.5.
Likely exposure
Exposure is limited to Skytable deployments running versions earlier than 0.6.4, especially where TCP or TLS listeners are reachable by untrusted networks or users. The source bundle does not provide CPEs or downstream package details.
Exploitation context
The advisory describes unauthenticated network denial of service with low complexity and no user interaction. It cites incomplete TLS connections and specially crafted TCP input as attack vectors. The bundle does not show CISA KEV listing or confirmed active exploitation.
Researcher notes
The weakness maps to CWE-252 and CWE-253 around unchecked or incorrectly checked return values. Evidence supports availability impact, not data theft or integrity compromise. No exploit code, active exploitation confirmation, or additional affected products are provided in the bundle.
Mitigation direction
- Upgrade Skytable to version 0.6.4 or later.
- Restrict Skytable listener access to trusted networks only.
- Place network filtering in front of exposed TCP or TLS endpoints.
- Monitor for unexpected Skytable process exits or restarts.
- Check Skytable vendor guidance for deployment-specific instructions.
Validation and detection
- Inventory all Skytable instances and record running versions.
- Confirm no production instance is below version 0.6.4.
- Review exposed TCP and TLS listener reachability.
- Check logs for unexpected shutdowns after connection handling errors.
- Verify monitoring alerts on Skytable service termination.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-252: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-253: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-37625 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/skytable/skytable/security/advisories/GHSA-q27r-h25m-hcc7CVE reference · x_refsource_CONFIRM
- https://github.com/skytable/skytable/commit/bb19d024ea1e5e0c9a3d75a9ee58ff03c70c7e5dCVE reference · x_refsource_MISC
- https://security.skytable.io/ve/s/00002.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.