CVE-2025-3985: Apereo CAS Management Webapp Suffers from Inefficient Regular Expression Complexity
Summary
CVE-2025-3985: Apereo CAS has inefficient regular expression complexity. Affects org.apereo.cas:cas-management-webapp-support versions < 5.2.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apereo CAS (Central Authentication Service) is an open-source enterprise single sign-on solution for web applications. It provides a centralized authentication service to various applications, allowing users to log in once and gain access to multiple services. The CAS Management Webapp is a component that allows administrators to manage registered services and their configurations. However, a vulnerability in version 5.2.6 has been identified, which can lead to performance issues due to inefficient regular expression handling.
Vulnerability Detail
A vulnerability was discovered in Apereo CAS 5.2.6, specifically in the ResponseEntity function of the ManageRegisteredServicesMultiActionController.java file. The issue arises from the manipulation of the Query argument, leading to inefficient regular expression complexity. This vulnerability can be exploited remotely, potentially allowing attackers to degrade the performance of the application. The vendor was notified but did not respond, and the exploit has been publicly disclosed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit the complexity of the queries being processed by the application to avoid triggering the inefficient regular expression handling. This may involve simplifying the input or implementing stricter validation on the Query parameters.
Conclusion
In summary, CVE-2025-3985 affects Apereo CAS 5.2.6 due to inefficient regular expression complexity, which can lead to performance issues. Users are encouraged to update to a patched version to mitigate the risk and can utilize Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for org.apereo.cas:cas-management-webapp-support →
FAQ
CVE-2025-3985 is a vulnerability in Apereo CAS 5.2.6 that involves inefficient regular expression complexity, which can lead to performance degradation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can be exploited remotely, potentially leading to performance issues in the application, affecting user experience.
Yes, users are advised to update to a version later than 5.2.6 to mitigate this vulnerability.
The CVSS score for this vulnerability is 2.7, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apereo.cas:cas-management-webapp-support.
