Java LocalImageResolver DoS via onHeaderDecoded
CVE-2025-48631 Published on December 8, 2025

In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2025-48631 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is a Resource Exhaustion Vulnerability?

The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CVE-2025-48631 has been classified to as a Resource Exhaustion vulnerability or weakness.


Products Associated with CVE-2025-48631

stack.watch emails you whenever new vulnerabilities are published in Google Android or Apache Pdfbox. Just hit a watch button to start following.

 
 

Affected Versions

Google Android:

Exploit Probability

EPSS
0.16%
Percentile
36.80%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.