CVE-2025-36171
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption.
Risk Assessment
A privileged user could cause service unavailability, disrupting file transfers and business operations. This may lead to downtime and productivity losses.
Recommendation
Update IBM Aspera Faspex to the latest version and implement additional API input validation controls.
Other vulnerabilities in IBM Aspera Faspex
See all- CVE-2026-14959Critical
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via shell command injection.
- CVE-2026-14958Critical
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via unquoted shell interpolation.
- CVE-2022-47986CriticalActively exploited
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2.
- CVE-2026-14996High
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
- CVE-2025-36230Medium
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
- CVE-2025-36229Low
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.14.1 allow authenticated users to enumerate package identifiers, leading to disclosure of sensitive data information. The vulnerability enables information leakage through identifier guessing.
- CVE-2025-36228Low
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.14.1 may have inconsistent permissions between the user interface and backend API, allowing users to access features that appeared disabled. This could lead to misuse.
Original NVD description (English source)
IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS