LiveActive security incident?Get immediate response
CVE Record

CVE-2025-11362: Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of...

Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.

HighCVSS 8.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Affected pdfmake beta versions can be forced to consume resources while following repeated redirects for an embedded file. In applications accepting attacker-controlled document input, this may crash or freeze PDF generation, disrupting dependent services. The reported impact is availability loss, not data theft or modification.

Executive priority

Prioritize remediation for internet-facing or multi-tenant PDF services that accept untrusted document content. A successful attack could interrupt document generation or exhaust shared capacity without authentication. Internal systems processing only trusted templates can follow normal high-severity patching timelines after confirming their input boundaries.

Technical view

CVE-2025-11362 is a CWE-770 resource-allocation flaw affecting pdfmake versions from 0.3.0-beta.1 through versions before 0.3.0-beta.17, including its npm WebJar packaging. Repeated URL redirects during file embedding can exhaust resources. CVSS 4.0 rates it 8.7, with network reachability, low complexity, no privileges or interaction, and high availability impact.

Likely exposure

Exposure is most likely where affected pdfmake code processes documents containing attacker-controlled remote file URLs. Risk is lower if remote embedding is disabled, input is trusted, or the vulnerable beta range is absent. Both direct npm dependencies and org.webjars.npm:pdfmake should be inventoried.

Exploitation context

The supplied record does not identify known active exploitation, and the CVE is not listed as KEV in the bundle. The CVSS vector indicates a remotely triggerable, unauthenticated condition, but practical reachability depends on whether an application lets untrusted input influence embedded-file URLs.

Researcher notes

The evidence supports uncontrolled resource allocation during redirect handling and availability-only impact. The referenced upstream commit indicates a code-level correction, while the stated affected range places 0.3.0-beta.17 outside vulnerability scope. The bundle provides no exploit observations, deployment prevalence, or proof that every application using the package exposes the vulnerable path.

Mitigation direction

  • Upgrade pdfmake to 0.3.0-beta.17 or a later vendor-supported release.
  • Update org.webjars.npm:pdfmake where the affected beta range is packaged.
  • Temporarily disable untrusted remote file embedding when immediate upgrading is impossible.
  • Apply resource limits and availability monitoring around PDF-generation services as defense in depth.

Validation and detection

  • Inspect manifests and lockfiles for pdfmake versions from 0.3.0-beta.1 through 0.3.0-beta.16.
  • Check Java dependencies for affected org.webjars.npm:pdfmake packaging.
  • Trace whether untrusted document data can control remote embedded-file URLs.
  • Confirm production artifacts contain the upgraded version, not only updated manifests.
  • Review service telemetry for redirect loops, resource exhaustion, crashes, or prolonged PDF jobs.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-770: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-11362 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.7 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.7CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——snyk
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6snyk

Vulnerability scoring details

Base CVSS 4.0 score

8.7High
CVSS 4.0 vector shape for CVE-2025-11362Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/apdfmake0.3.0-beta.1Listed
n/aorg.webjars.npm:pdfmake0.3.0-beta.1Listed
Weakness

CWE details

CWE-770

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-770 · source CWE mapping

Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs