Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2025-32952: Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development

36
Routine
MEDIUM 6.5UPGRADEUPGRADEUPGRADE

CVE-2025-32952 is a medium-severity flaw (CVSS 6.5) affecting cuba platform, cuba rest api, jmix framework. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in versions

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score6.5 (Medium)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance0.7% (top 47%)
CISA exploited listNo
WeaknessCWE-770
Published2025-04-22
Last modified2026-06-17
Publisher (CNA): GitHub, Inc. · Vendor: haulmont

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

haulmont cuba platform UPGRADE
Affected: >= 6.2.0 and < 7.2.23
Fixed in: 7.2.23
Safe to downgrade to: a release before 6.2.0
1. Check installed version
apt-cache policy cuba-platform || rpm -q cuba-platform || cuba-platform --version
2. UPGRADE to 7.2.23 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade cuba-platform
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade cuba-platform
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 6.2.0 (Debian / Ubuntu)
apt-cache madison cuba-platform sudo apt install cuba-platform=<VERSION_BEFORE_6.2.0> sudo apt-mark hold cuba-platform
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list cuba-platform sudo dnf downgrade cuba-platform-<VERSION_BEFORE_6.2.0> sudo dnf versionlock add cuba-platform
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
haulmont cuba rest api UPGRADE
Affected: >= 7.1.1 and < 7.2.7
Fixed in: 7.2.7
Safe to downgrade to: a release before 7.1.1
1. Check installed version
apt-cache policy cuba-rest-api || rpm -q cuba-rest-api || cuba-rest-api --version
2. UPGRADE to 7.2.7 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade cuba-rest-api
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade cuba-rest-api
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 7.1.1 (Debian / Ubuntu)
apt-cache madison cuba-rest-api sudo apt install cuba-rest-api=<VERSION_BEFORE_7.1.1> sudo apt-mark hold cuba-rest-api
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list cuba-rest-api sudo dnf downgrade cuba-rest-api-<VERSION_BEFORE_7.1.1> sudo dnf versionlock add cuba-rest-api
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
haulmont jmix framework UPGRADE
Affected: >= 1.0.0 and < 1.6.2 · >= 2.0.0 and < 2.4.0
Fixed in: 1.6.2, 2.4.0
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy jmix-framework || rpm -q jmix-framework || jmix-framework --version
2. UPGRADE to 1.6.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade jmix-framework
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade jmix-framework
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison jmix-framework sudo apt install jmix-framework=<VERSION_BEFORE_1.0.0> sudo apt-mark hold jmix-framework
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jmix-framework sudo dnf downgrade jmix-framework-<VERSION_BEFORE_1.0.0> sudo dnf versionlock add jmix-framework
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
haulmont jpa web api UPGRADE
Affected: >= 1.0.0 and < 1.1.1
Fixed in: 1.1.1
Safe to downgrade to: a release before 1.0.0
1. Check installed version
apt-cache policy jpa-web-api || rpm -q jpa-web-api || jpa-web-api --version
2. UPGRADE to 1.1.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade jpa-web-api
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade jpa-web-api
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)
apt-cache madison jpa-web-api sudo apt install jpa-web-api=<VERSION_BEFORE_1.0.0> sudo apt-mark hold jpa-web-api
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jpa-web-api sudo dnf downgrade jpa-web-api-<VERSION_BEFORE_1.0.0> sudo dnf versionlock add jpa-web-api
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-32952?

cuba platform: upgrade to 7.2.23; cuba rest api: upgrade to 7.2.7; jmix framework: upgrade to 1.6.2, 2.4.0. Exact commands for each OS are on this page.

Is CVE-2025-32952 being exploited?

CVE-2025-32952 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-32952 affect?

CVE-2025-32952 affects cuba platform, cuba rest api, jmix framework. Severity is medium (CVSS 6.5). Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacke

How urgent is CVE-2025-32952?

Priority 36/100. No elevated risk signals yet.

Software pages

Spring Framework vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.