CVE-2025-33096: IBM DOORS Next DOS Vulnerability

CVE-2025-33096 Overview

CVE-2025-33096 affects IBM Engineering Requirements Management DOORS Next versions 7.0.2, 7.0.3, and 7.1. An authenticated user can trigger a denial of service by uploading specially crafted files that cause uncontrolled recursion [CWE-674] in the application. Successful exploitation exhausts server resources and disrupts availability for all users of the requirements management platform.

The issue affects deployments across IBM AIX, Linux, and Microsoft Windows operating systems. IBM published a support advisory documenting affected releases and remediation guidance.

Critical Impact
Any authenticated user can crash or degrade the DOORS Next service by uploading a malicious file, halting requirements engineering workflows across the affected environment.

Affected Products

IBM Engineering Requirements Management DOORS Next 7.0.2
IBM Engineering Requirements Management DOORS Next 7.0.3
IBM Engineering Requirements Management DOORS Next 7.1

Discovery Timeline

2025-10-12 - CVE-2025-33096 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-33096

Vulnerability Analysis

CVE-2025-33096 is a denial-of-service vulnerability caused by uncontrolled recursion during file upload processing in IBM Engineering Requirements Management DOORS Next. When the application parses attacker-supplied file structures, a recursive parser descends without a termination guard proportional to the input depth.

The recursion consumes stack frames or heap allocations until the process exhausts available resources. This results in a stack overflow, thread termination, or wider service failure. Because the vulnerable code path is reached through an authenticated file upload, any user with upload permissions can trigger the condition.

The flaw does not expose data confidentiality or integrity. The impact is confined to availability, but a single request can affect all concurrent users of the DOORS Next instance.

Root Cause

The root cause is uncontrolled recursion [CWE-674] in the file processing logic. The parser lacks depth limits or cycle detection when handling nested structures within uploaded files. A crafted file with deeply nested elements or self-referential constructs drives the recursion beyond safe bounds.

Attack Vector

Exploitation requires network access to the DOORS Next web interface and valid low-privilege credentials. The attacker authenticates, then uploads a specially crafted file through a standard upload endpoint. No user interaction is required from other users. The vulnerability is described in prose only; no public proof-of-concept is available. Refer to the IBM Support Page for vendor guidance.

Detection Methods for CVE-2025-33096

Indicators of Compromise

Sudden termination or repeated restarts of DOORS Next Java application server processes without corresponding administrator activity.
Stack overflow exceptions or StackOverflowError entries in DOORS Next application logs following a file upload event.
Spikes in memory or CPU consumption on the DOORS Next server coinciding with upload requests from a single authenticated user.

Detection Strategies

Correlate authenticated file upload events with subsequent service crashes, unhealthy health-check responses, or worker thread restarts.
Inspect uploaded files for excessive nesting depth or self-referential structures prior to acceptance by the parser.
Alert on repeated 5xx responses from DOORS Next upload endpoints originating from the same user session.

Monitoring Recommendations

Enable verbose logging on DOORS Next upload handlers and forward logs to a centralized SIEM for correlation.
Monitor JVM heap and stack metrics, escalating on sustained pressure or repeated exception patterns.
Track per-user upload rates and file sizes to identify anomalous submission patterns indicative of DoS attempts.

How to Mitigate CVE-2025-33096

Immediate Actions Required

Apply the fix referenced in the IBM Support Page for versions 7.0.2, 7.0.3, and 7.1.
Restrict file upload privileges to trusted users until the patch is deployed.
Audit recent uploads and user accounts for suspicious activity targeting DOORS Next upload endpoints.

Patch Information

IBM has published remediation guidance on the IBM Support Page. Administrators should review the advisory to identify the appropriate iFix or upgrade path for each affected release and apply updates during a scheduled maintenance window.

Workarounds

Place a reverse proxy or web application firewall in front of DOORS Next to enforce upload size limits and reject deeply nested file structures.
Reduce concurrent upload permissions through role-based access control until patching is complete.
Configure JVM resource limits and automatic service restarts to shorten recovery time after a triggered crash.

bash

# Example WAF rule concept: block oversized uploads to DOORS Next endpoints
# Adjust size threshold and path to match your deployment
location /rm/ {
    client_max_body_size 10m;
    proxy_pass http://doors_next_backend;
}