# CVE-2025-66473: xwiki-platform-rest — Fixed in 16.10.11 ☕ Maven Not in CISA KEV # CVE-2025-66473 — xwiki-platform-rest-server [Fix: xwiki/xwiki-platform@e3c4774](https://github.com/xwiki/xwiki-platform/commit/e3c47745195fb445b054537be86f5c01ee69558b) CVE-2025-66473 is a CWE-770 vulnerability in org.xwiki.platform:xwiki-platform-rest-server. A fix is available for org.xwiki.platform:xwiki-platform-rest-server — see the affected versions and patch details below. XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis Also known as[GHSA-cc84-q3v3-mhgf](/vulnerability/GHSA-cc84-q3v3-mhgf) Published Dec 10, 2025 Updated Oct 28, 2026 Affected 3 pkgs Patched 3 / 3 Exploits None indexed Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. - CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks. Exploitation and automatability from CISA’s SSVC triage for CVE-2025-66473. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.4%probability of exploitation in next 30 days Lower Risk+0.03% Lower risk than most CVEs38th percentile — riskier than 38% of all scored CVEsHighest risk 0.00%0.31%0.62%0.93%0.1%0.4%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 3 pkgs affected ☕`org.xwiki.platform:xwiki-platform-rest-server`☕`org.xwiki.platform:xwiki-platform-rest-server`☕`org.xwiki.platform:xwiki-platform-rest-server` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems. ## Description #### Impact XWiki's REST API doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the `/rest/wikis/xwiki/spaces` resource returns all spaces on the wiki by default, which are basically all pages. #### Patches XWiki 17.7.0RC1, 17.4.4 and 16.10.11 introduce a configurable limit, limiting responses to 1000 items by default. Requesting larger limits leads to an error now. #### Workarounds We're not aware of any workaround, except denying access to the affected REST resources in a proxy in front of XWiki. ## Affected Packages 3 total 3 fixed Ecosystem Package Vulnerable range Fix ☕Maven `org.xwiki.platform:xwiki-platform-rest-server` all versions 16.10.11`org.xwiki.platform:xwiki-platform-rest-server:16.10.11` ☕Maven `org.xwiki.platform:xwiki-platform-rest-server` ≥ 17.0.0-rc-1&&< 17.4.4 17.4.4`org.xwiki.platform:xwiki-platform-rest-server:17.4.4` ☕Maven `org.xwiki.platform:xwiki-platform-rest-server` ≥ 17.5.0-rc-1&&< 17.7.0-rc-1 17.7.0-rc-1`org.xwiki.platform:xwiki-platform-rest-server:17.7.0-rc-1` ## Affected Products 1 product · 3 configurations Application `xwiki`xwiki ≥ 17.5.0 && ≤ 17.6.0 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.xwiki.platform:xwiki-platform-rest-server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update org.xwiki.platform:xwiki-platform-rest-server to 16.10.11 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-66473 is resolved across your whole dependency graph. 3. ### Workarounds Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service. ## Frequently Asked Questions \### Impact XWiki's REST API doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the \`/rest/wikis/xwiki/spaces\` resource returns all spaces on the wiki by default, which are basically all pages. ### Patches XWiki 17.7.0RC1, 17.4.4 and 16.10.11 introduce a configurable limit, limiting responses to 1000 items by default. Requesting larger limits leads to an error now. ### Workarounds We're not O3 Security · Impact-Aware SCA ### Is CVE-2025-66473 in your dependencies? Find it across Maven, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)