Back to Database
Status published
Medium
CVE-2025-53636
Open OnDemand Shell App closed websocket DoS
Vulnerability Description
Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service (DoS) to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53636
Credits & Attribution
No credits recorded in the NVD database.
References
More from OSC
View All →CVE-2025-66029
Open OnDemand affected by Apache proxy passing sensitive headers
High
7.6
CVE-2025-64185
Open OnDemand RPM packages create world writable locations
Medium
6.9
CVE-2025-62724
Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)
Medium
4.3
CVE-2025-58435
Open OnDemand didn't rotate password for VNC batch_connect
Medium
4.1
Affected Vendor
Affected Software
ondemand
Vulnerable Versions:
>= 1.6, < 3.1.14, >= 4.0.0-0.rc1, < 4.0.6
Timeline
Official Publish:
July 11th, 2025
Last Modified:
July 14th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L