CVE-2025-56264

HighCVSS 7.5

Published: 16/09/2025(UTC)Updated: 07/11/2026(UTC)Translated: 07/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

35th percentile - higher than 35% of all known CVEs

Summary

The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability.

Risk Assessment

An attacker can remotely cause unavailability of the application or its resources, disrupting the blog service. The risk affects service availability.

Recommendation

Update OneBlog to a patched version or implement restrictions on the /api/comment endpoint. Also monitor for unusual traffic and implement rate limiting.

Other vulnerabilities in OneBlog

CVE-2026-51937High
An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and GetAccessTokenComponent.java components.

Original NVD description (English source)

The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS