CVE-2025-59250: SQL Server JDBC Driver Spoofing Vulnerability Due to Improper Input Validation
Summary
CVE-2025-59250: JDBC Driver for SQL Server has improper input validation issue. Affects com.microsoft.sqlserver:mssql-jdbc across 7 version ranges.
>= 0.2.0-SNAPSHOT.jre8-preview, < 10.2.4.jre8
>= 11.2.0.jre8, < 11.2.4.jre8
>= 12.2.0.jre8, < 12.2.1.jre8
>= 12.6.0.jre8, < 12.6.5.jre8
>= 12.8.0.jre8, < 12.8.2.jre8
>= 12.10.0.jre8, < 12.10.2.jre8
>= 13.2.0.jre8, < 13.2.1.jre8
Fixed in 7 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The JDBC Driver for SQL Server is a crucial component that enables Java applications to interact with Microsoft SQL Server databases. It provides a standard interface for database connectivity, allowing developers to execute SQL queries and manage database transactions seamlessly. However, this driver has been found to have an improper input validation issue, which can expose applications to security risks.
Vulnerability Detail
The vulnerability arises from improper input validation within the JDBC Driver for SQL Server. This flaw allows unauthorized attackers to perform spoofing attacks over a network, potentially leading to unauthorized access to sensitive data or manipulation of database operations. The vulnerability is classified under CWE-20, indicating that it stems from a failure to validate input properly, which can have severe implications for data integrity and confidentiality.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.2.0-SNAPSHOT.jre8-preview, < 10.2.4.jre810.2.4.jre8 -
>= 11.2.0.jre8, < 11.2.4.jre811.2.4.jre8 -
>= 12.2.0.jre8, < 12.2.1.jre812.2.1.jre8 -
>= 12.6.0.jre8, < 12.6.5.jre812.6.5.jre8 -
>= 12.8.0.jre8, < 12.8.2.jre812.8.2.jre8 -
>= 12.10.0.jre8, < 12.10.2.jre812.10.2.jre8
Show all 7 release lines
-
>= 13.2.0.jre8, < 13.2.1.jre813.2.1.jre8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider implementing network-level security measures, such as firewalls and intrusion detection systems, to mitigate the risk of spoofing attacks while you work on applying the patch.
Conclusion
In summary, CVE-2025-59250 represents a significant security risk for applications using the JDBC Driver for SQL Server due to improper input validation. It is crucial to update to the latest patched versions to safeguard against potential spoofing attacks.
See every vulnerability recorded for com.microsoft.sqlserver:mssql-jdbc →
FAQ
CVE-2025-59250 is a vulnerability in the JDBC Driver for SQL Server that allows unauthorized spoofing attacks due to improper input validation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive data, manipulation of database operations, and compromise of data integrity.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
You can update the driver by modifying your pom.xml file to include the latest patched version of the mssql-jdbc dependency.
