Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-29954
CVE-2025-29954:
vulnerability analysis and mitigation
Overview
A vulnerability identified as CVE-2025-29954 was disclosed on May 13, 2025, affecting Windows LDAP (Lightweight Directory Access Protocol). The vulnerability stems from uncontrolled resource consumption that enables unauthorized attackers to perform denial of service attacks over a network (NVD, Wiz).
Technical details
The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. It is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerability requires network access but no privileges or user interaction to exploit (NVD).
Impact
When successfully exploited, this vulnerability enables unauthorized attackers to cause a denial of service condition in Windows LDAP services over a network. This can potentially disrupt critical directory services, affecting the availability of dependent systems (Wiz).
Mitigation and workarounds
Microsoft has addressed this vulnerability by releasing security updates as part of the May 2025 Patch Tuesday. System administrators are strongly advised to apply the latest security updates to all affected systems (Wiz).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management