CVE-2025-27100 - CVE House
Back to Database
Status published Medium CVE-2025-27100

An authenticated user can crash lakeFS by exhausting server memory

Vulnerability Description

lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below are affected. Users are advised to upgrade. Users unable to upgrade should either set the environment variable `LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART` to `true` or configure the `disable_pre_signed_multipart` key to true in their config yaml.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-27100

Credits & Attribution

No credits recorded in the NVD database.

References

More from treeverse

View All →
CVE-2025-68671
lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
Medium 6.5
CVE-2025-64179
lakeFS: Unauthenticated access to API usage metrics
Medium 5.3
CVE-2024-43784
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion
Medium 5.7

Affected Vendor

Affected Software

lakeFS
Vulnerable Versions:
< 1.50.0

Timeline

Official Publish: February 21st, 2025
Last Modified: February 21st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact