Read the docs
TI-2025-08113 Aliases CVE-2025-8863GHSA-58pc-g9rc-gr6v

YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission

Priority LOW 30CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-319.

Summary

YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Partial YugabyteDB (YugabyteDB Inc): 2024.1.3, 2.20.7.0, 2.23.1.0Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
YugabyteDBYugabyteDB2024.1.0 to before 2024.1.3; 2.20.0.0 to before 2.20.7.0; 2.23.0.0 to before 2.23.1.02024.1.3, 2.20.7.0, 2.23.1.0Patch availableCNA
  • YugabyteDB VendorYugabyteDB Affected 2024.1.0 to before 2024.1.3; 2.20.0.0 to before 2.20.7.0; 2.23.0.0 to before 2.23.1.0 Fixed in 2024.1.3, 2.20.7.0, 2.23.1.0 Patch available CNA

Remediation

  • Fix · CNA YugabyteDB (YugabyteDB Inc) Fixed in 2024.1.3, 2.20.7.0, 2.23.1.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    YugabyteDB 2.20.7.0, 2.23.1.0, 2024.1.3

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-08112 YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may…Priority LOW 31
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-8863
  2. 2026-10-03 Alias added: GHSA-58pc-g9rc-gr6v

References

Other 1

  • TI-2024-27623 YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter. CVSS 3.1HIGH 7.5
  • TI-2023-00545 Remote code execution in YugabyteDB CVSS 3.1CRITICAL 9.8
  • TI-2022-17471 The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory CVSS 3.1CRITICAL 9.8
  • TI-2023-00707 Arbitrary File Write in High Availability Backup Upload CVSS 3.1CRITICAL 9.8
  • TI-2023-00544 Server-side request forgery in YugabyteDB Anywhere CVSS 3.1CRITICAL 9.8
  • TI-2023-05529 Prometheus Metrics Accessible Pre-Authentication CVSS 3.1HIGH 7.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences