CVE-2025-27100: An authenticated user can crash lakeFS by exhausting server memory
Impact
An authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue.
Patches This problem has been patched and exists in versions 1.49.1 and below
Workarounds
On S3 backends, configure yaml ... blockstore: s3: disablepresignedmultipart: true or set environment variable LAKEFSBLOCKSTORES3DISABLEPRESIGNEDMULTIPART to true.
References Are there any links users can visit to find out more?
Other sources
lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below are affected. Users are advised to upgrade. Users unable to upgrade should either set the environment variable LAKEFSBLOCKSTORES3DISABLEPRESIGNEDMULTIPART to true or configure the disablepresignedmultipart key to true in their config yaml.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/treeverse/lakefsto a version that resolves this vulnerability.Fixed in 1.50.0 - Upgrade
Upgrade
lakeFSto a version that resolves this vulnerability.Fixed in 1.50.0 - Configuration
Set `blockstore.disable_pre_signed_multipart: true` in your config yaml on versions 1.49.1 and below if you are unable to upgrade.
lakeFS (blockstore / S3 backend) blockstore.disable_pre_signed_multipart = true - Configuration
Set environment variable `LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART=true` on versions 1.49.1 and below if you are unable to upgrade.
lakeFS (blockstore / S3 backend) LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART = true
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27100?
The severity of CVE-2025-27100 is classified as an authenticated denial-of-service (DoS) vulnerability.
How do I fix CVE-2025-27100?
To fix CVE-2025-27100, upgrade to lakeFS version 1.50.0 or later.
What versions of lakeFS are affected by CVE-2025-27100?
Versions of lakeFS prior to 1.50.0 are affected by CVE-2025-27100.
What type of attack does CVE-2025-27100 exploit?
CVE-2025-27100 exploits a vulnerability allowing an authenticated user to crash lakeFS by exhausting server memory.
Is CVE-2025-27100 a remote access vulnerability?
CVE-2025-27100 is not a remote access vulnerability; it requires authenticated user access to exploit.