CVE-2025-59836
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-13

Last updated on: 2025-12-04

Assigner: GitHub, Inc.

Description
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource requests through the API endpoints. The vulnerability exists in the isSensitiveSpec function which calls grpcomni.CreateResource without checking if the resource's metadata field is nil. When a resource is created with an empty Metadata field, the CreateResource function attempts to access resource.Metadata.Version causing a segmentation fault. This vulnerability is fixed in 1.1.5 and 1.0.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-13
Last Modified
2025-12-04
Generated
2026-06-16
AI Q&A
2025-10-14
EPSS Evaluated
2026-06-15
NVD
CVE-2025-59836
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
siderolabs omni to 1.0.2 (exc)
siderolabs omni From 1.1.0 (inc) to 1.1.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-703 The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a nil pointer dereference in the Omni Resource Service that allows unauthenticated users to cause a server panic and denial of service. It occurs when empty create or update resource requests are sent through the API endpoints. Specifically, the isSensitiveSpec function calls CreateResource without checking if the resource's metadata field is nil. If the Metadata field is empty, CreateResource tries to access resource.Metadata.Version, causing a segmentation fault and crashing the server.

Impact Analysis

The vulnerability can cause a denial of service by crashing the server when it receives empty create or update resource requests. This means an attacker can disrupt the availability of the Omni Resource Service without authentication, potentially impacting the stability and reliability of Kubernetes management on bare metal, virtual machines, or cloud environments.

Mitigation Strategies

Upgrade the Omni Resource Service to version 1.1.5 or 1.0.2 or later, as these versions contain the fix for the nil pointer dereference vulnerability that causes server panic and denial of service.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-59836. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart