Java LocalImageResolver DoS via onHeaderDecoded
CVE-2025-48631 Published on December 8, 2025
In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Vulnerability Analysis
CVE-2025-48631 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2025-48631 has been classified to as a Resource Exhaustion vulnerability or weakness.
Products Associated with CVE-2025-48631
stack.watch emails you whenever new vulnerabilities are published in Google Android or Apache Pdfbox. Just hit a watch button to start following.
Affected Versions
Google Android:- Version 16-qpr2 is affected.
- Version 16 is affected.
- Version 15 is affected.
- Version 14 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.