CVE-2025-66473: XWiki REST API Unavailability Due to Lack of Request Limits
Summary
CVE-2025-66473: XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis. Affects org.xwiki.platform:xwiki-platform-rest-server across 3 version ranges.
< 16.10.11
>= 17.0.0-rc-1, < 17.4.4
>= 17.5.0-rc-1, < 17.7.0-rc-1
Fixed in 16.10.11, 17.4.4 or 17.7.0-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki is a powerful open-source wiki platform that allows users to create, manage, and share content collaboratively. It features a robust REST API that enables developers to interact with the wiki programmatically. However, the API's lack of enforced limits on the number of items returned in a single request can lead to performance issues, particularly in large wikis, making it susceptible to denial-of-service conditions.
Vulnerability Detail
The vulnerability arises from XWiki's REST API not enforcing limits on the number of items that can be requested in a single API call. This oversight can result in excessive memory consumption and slow response times, potentially leading to the unavailability of the wiki. For instance, the endpoint '/rest/wikis/xwiki/spaces' returns all spaces in the wiki by default, which can overwhelm the server if the wiki contains a large number of pages.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 16.10.1116.10.11 -
>= 17.0.0-rc-1, < 17.4.417.4.4 -
>= 17.5.0-rc-1, < 17.7.0-rc-117.7.0-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can deny access to the affected REST resources by configuring a proxy in front of XWiki. This will prevent users from making requests that could lead to performance degradation.
Conclusion
In summary, CVE-2025-66473 presents a significant risk to XWiki instances with large datasets due to the lack of request limits in the REST API. It is crucial to update to the latest patched versions to mitigate this vulnerability and ensure the stability of your wiki.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-rest-server →
FAQ
CVE-2025-66473 is a vulnerability in XWiki's REST API that allows excessive data requests, potentially leading to server unavailability.
If your XWiki instance has a large number of pages, this vulnerability can cause slowdowns or make the wiki completely unavailable due to high memory usage.
Versions prior to 16.10.11, 17.4.4, and 17.7.0RC1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update your XWiki instance immediately, consider implementing a proxy to deny access to the affected REST resources as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-rest-server.
