CVE-2025-0649

8.9 highEPSS 0.2%

High (8.9) in google tensorflow serving. EPSS 0.2% chance of exploitation in the next 30 days.

Incorrect JSON input stringification in Google's Tensorflow serving versions up to 2.18.0 allows for potentially unbounded recursion leading to server crash.

Severity

CVSS 4.0

8.9 high

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-31)
CWEs: CWE-787, CWE-121
Published: 2025-05-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

google:tensorflow_serving

References

https://github.com/tensorflow/serving/commit/6cb013167d13f2ed3930aabb86dbc2c8c53f5adf

Check your stack JSON