Vulnerability DatabaseCVE-2025-45766

CVE-2025-45766:
Linux Debian vulnerability analysis and mitigation

Overview

The vulnerability CVE-2025-45766 affects poco v1.14.1-release and earlier versions, which was discovered to contain weak encryption implementation. The vulnerability was disclosed on August 6, 2025, specifically related to inadequate encryption strength in the HMAC and RSA key lengths used in the JSON Web Signature (JWS) implementation (GitHub Gist).

Technical details

The vulnerability is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). The CVSS v3.1 base score is 7.0 (High), with the following vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H. The implementation uses key lengths that do not meet recommended security standards according to RFC 7518, NIST SP800-117, and RFC 2437 (GitHub Gist).

Impact

The vulnerability can lead to compromised security in applications using the affected POCO library versions. The impact assessment shows Low impact on Confidentiality and Integrity, but High impact on Availability. The vulnerability is accessible through network vectors, requires no privileges or user interaction, though it has high attack complexity (Ubuntu Security).

Mitigation and workarounds

Users are advised to upgrade to versions newer than v1.14.1-release when available. Currently, the vulnerability remains unfixed in several distributions including Debian's unstable branch (Debian Security).