CVE-2024-25039

HighCVSS 7.5

Published: 30/07/2026(UTC)Updated: 12/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

IBM Engineering Requirements Management DOORS and DOORS Web Access versions 9.7.2.1 through 9.7.2.11 and 9.6.1.1 through 9.6.1.13 do not limit connection length, allowing a Slowloris HTTP denial of service attack. This can cause the web server to become unresponsive.

Risk Assessment

A Slowloris attack can render the web server unavailable, disrupting DOORS system access for users and impacting requirements management processes.

Recommendation

Upgrade IBM Engineering Requirements Management DOORS and DOORS Web Access to versions later than 9.7.2.11 or 9.6.1.13 that include a fix for connection length limitation.

Other vulnerabilities in IBM Engineering Requirements Management DOORS

CVE-2025-0152Medium
IBM Engineering Requirements Management DOORS and DOORS Web Access are vulnerable to cross-site scripting (XSS). An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI.

Original NVD description (English source)

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the web server to become unresponsive.