dbcve.org
Resource Allocation Without LimitsWeakness · CWE-770

CVE-2025-0695

MEDIUM · 5.3 CVSS v3.1 Published 2025-01-27
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
62/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Cesanta Frozen versions before 1.7 lack proper resource limits when parsing JSON input. An attacker can supply a specially crafted JSON that causes excessive resource allocation (memory, CPU, or stack), leading to a crash of the component using the library.

MitigationUpgrade Cesanta Frozen to version 1.7 or later. If upgrading is not immediately possible, implement input validation and resource limits (max input size, recursion depth limits) on JSON parsing operations.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Locate the Cesanta Frozen library in your environment
    Search for files named 'frozen.c', 'frozen.h', 'libfrozen', or similar artifacts in your project dependencies, vendor directories, or embedded firmware images
    Affected if The library is present in your environment
  2. Identify the installed version of Cesanta Frozen
    Check version information in the library source files, build system (Makefile, CMakeLists.txt, package.json), or binary metadata. Look for version macros or tags such as FROZEN_VERSION, frozen_version, or version.h
    Affected if The version is below 1.7 (e.g., 1.6, 1.5, 1.0) or no version information is found indicating an older release
  3. Determine if your application or service parses JSON using Frozen
    Review your codebase for calls to json_parse(), json_parse_typed(), fjson_parse(), or other Frozen parsing functions. Check integration points where external JSON input is received
    Affected if JSON parsing functions from Cesanta Frozen are actively used to process input data
  4. Verify whether resource limits are enforced on JSON parsing operations
    Inspect the parsing code for limits on input size (max length check), recursion depth (depth counter), or memory allocation bounds before calling the parse function
    Affected if No resource limits exist and the library version is below 1.7 - the vulnerability is exploitable
  5. Check for vulnerable code paths accepting untrusted JSON input
    Identify endpoints, APIs, configuration loaders, or file parsers that pass external JSON data to Frozen functions without prior sanitization or limits
    Affected if Untrusted JSON input reaches the parsing function and the library version is below 1.7

You are affected if Cesanta Frozen version below 1.7 is in use and your application parses JSON input with it without resource limits on size or recursion depth.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade Cesanta Frozen to version 1.7 or later. If upgrading is not immediately possible, implement input validation and resource limits (max input size, recursion depth limits) on JSON parsing operations.

Recommended fix Moderate confidence

Cesanta Frozen version 1.7

  1. Identify all projects and dependencies that include the Cesanta Frozen library (check package.json, requirements.txt, vendor directories, or similar dependency manifests)
  2. Determine the current version of Cesanta Frozen in use
  3. Upgrade the Cesanta Frozen library to version 1.7 or later by updating the dependency version in your project's dependency manager
  4. Run package manager update/install to fetch the new version (e.g., npm update, pip install --upgrade, or equivalent)
  5. Rebuild and recompile any components that link to or embed the Cesanta Frozen library
  6. Test that JSON parsing functionality works correctly with both valid and potentially malformed JSON input
  7. Verify the application starts and operates normally after the upgrade
Caveat Review the Cesanta Frozen changelog between your current version and 1.7 for any breaking changes in API or behavior

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing2.0 h
  • Review / QA1.0 h
7.0 hours of engineering $1,240
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,984.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-0695 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-0695 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data