Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-63913: OpenSBI Denial of Service Vulnerability

CVE-2025-63913 · published 3 months ago

Summary

OpenSBI, a software component that helps manage system resources, has a weakness that can be exploited by attackers to crash the system. This vulnerability affects systems that rely on OpenSBI and can cause significant disruptions if not addressed. Users should update to the latest version of OpenSBI to mitigate this risk.

What to do

Update debian opensbi to version 1.7-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:20.04:LTS	canonical	opensbi	All versions
Ubuntu:22.04:LTS	canonical	opensbi	All versions
Ubuntu:24.04:LTS	canonical	opensbi	All versions
Ubuntu:26.04:LTS	canonical	opensbi	All versions
Debian:12	debian	opensbi	All versions
Debian:14	debian	opensbi	< 1.7-1 Fix: upgrade to 1.7-1

Original advisory text

An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU ...

References

https://ubuntu.com/security/CVE-2025-63913 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-63913 Third Party Advisory
https://github.com/luojia65/opensbi-pmu2-crash Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2025-63913 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-400Uncontrolled Resource Consumption

Timeline

Published27 Jul 2026

Updated4 Nov 2026

First seen27 Jul 2026

Sources

CVE-2025-63913 · NVD

CVE-2025-63913 · MITRE

UBUNTU-CVE-2025-63913 · OSV

DEBIAN-CVE-2025-63913 · OSV

Track software like this

Free during beta