CVE-2025-65519: ezbookkeeping DOS Vulnerability

CVE-2025-65519 Overview

mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing. The application fails to validate nesting depth during parsing operations, allowing authenticated attackers to trigger denial of service conditions by uploading deeply nested malicious files. This results in CPU exhaustion, service degradation, or complete service unavailability.

Critical Impact

Authenticated attackers can cause complete service unavailability through CPU exhaustion by uploading specially crafted deeply nested JSON or XML files during import operations.

Affected Products

• mayswind ezbookkeeping version 1.2.0
• mayswind ezbookkeeping versions prior to 1.2.0

Discovery Timeline

• 2026-02-18 - CVE CVE-2025-65519 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-65519

Vulnerability Analysis

This vulnerability is classified as CWE-674 (Uncontrolled Recursion), which occurs when the application fails to properly limit the depth of recursive processing during file import operations. The ezbookkeeping application accepts JSON and XML file uploads for data import functionality but does not implement adequate depth validation during the parsing phase.

When processing deeply nested data structures, the parser consumes excessive CPU resources as it attempts to traverse and process each level of nesting. This can lead to complete service degradation as the server becomes overwhelmed with processing a single malicious request. The attack requires authentication, meaning only users with valid credentials can exploit this vulnerability.

Root Cause

The root cause stems from missing or inadequate input validation on the nesting depth of imported JSON and XML files. The application's parser recursively processes nested elements without enforcing a maximum depth limit, allowing attackers to craft files with extreme nesting levels that consume disproportionate server resources during parsing.

Attack Vector

The attack is executed over the network by an authenticated user uploading a maliciously crafted file through the application's import functionality. The attacker creates a JSON or XML file with thousands of nested levels, then submits it through the standard import mechanism. Upon parsing, the server's CPU becomes exhausted attempting to process the deeply nested structure.

The vulnerability mechanism involves crafting deeply nested JSON objects or XML elements that exploit the recursive parsing behavior. For example, an attacker could create a JSON structure with thousands of nested objects like {"a":{"a":{"a":...}}} repeated to extreme depths. When the parser encounters this structure, it recursively processes each level without bounds checking, leading to stack exhaustion or CPU resource depletion. Technical details and proof-of-concept information can be found in the GitHub Security Advisory.

Detection Methods for CVE-2025-65519

Indicators of Compromise

• Unusual CPU spikes during file import operations on ezbookkeeping servers
• Import requests containing abnormally large JSON or XML files with repetitive nested structures
• Server logs showing import operations taking significantly longer than typical processing times
• Application timeouts or service unavailability following file import attempts

Detection Strategies

• Monitor server CPU utilization for anomalous spikes correlated with import API endpoints
• Implement request payload size monitoring to detect unusually large import files
• Deploy application-layer monitoring to track parsing operation duration and resource consumption
• Review authentication logs for accounts repeatedly attempting file imports that trigger high resource usage

Monitoring Recommendations

• Configure alerting for CPU utilization exceeding normal thresholds on ezbookkeeping application servers
• Enable detailed logging of file import operations including file size, processing time, and user identity
• Implement rate limiting on import endpoints to reduce the impact of repeated exploitation attempts

How to Mitigate CVE-2025-65519

Immediate Actions Required

• Restrict file import functionality to trusted administrative users only until patched versions are available
• Implement rate limiting on import endpoints to reduce potential impact from exploitation
• Configure web application firewalls to inspect and limit the size of uploaded JSON and XML files
• Monitor for unusual CPU consumption patterns on servers running ezbookkeeping

Patch Information

Organizations should monitor the ezbookkeeping project for security updates that address this vulnerability. Review the GitHub Security Advisory for the latest patch information and update guidance. Upgrade to patched versions as soon as they become available.

Workarounds

• Disable the file import functionality entirely if it is not business-critical
• Implement a reverse proxy or WAF rule to limit the maximum request body size for import endpoints
• Configure server-level timeouts to terminate long-running parsing operations
• Restrict access to import functionality through network segmentation or access control lists

Until official patches are available, organizations should implement application-layer controls to limit import file sizes and parsing timeouts. Configure your web server or reverse proxy to enforce maximum request body sizes on import endpoints to reduce the effectiveness of deeply nested payload attacks.