Introduction
An outage in core middleware can stop the business applications that depend on it. Oracle WebLogic Server, a backbone for enterprise Java workloads, has a newly disclosed denial of service vulnerability that an attacker can exploit remotely and without authentication.
Oracle WebLogic Server is a widely deployed Java EE application server that large enterprises use to host business-critical applications. It is a flagship product in Oracle's Fusion Middleware suite and is used around the world in finance, healthcare, telecom, and government.
Technical Information
CVE-2025-61752 is a design defect in the HTTP/2 protocol handling of the Core component in Oracle WebLogic Server. An unauthenticated attacker with network access can send specially crafted HTTP/2 packets that make the server hang or crash repeatedly. The attack needs no privileges and no user interaction, and it can be launched remotely over the network.
The CVSS v3.1 vector for the vulnerability is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- AV:N: Attack is possible over the network
- AC:L: Low attack complexity
- PR:N: No privileges required
- UI:N: No user interaction required
- S:U: Scope is unchanged (impact is limited to the vulnerable component)
- C:N/I:N/A:H: No confidentiality or integrity impact, high availability impact
The flaw sits in the design of the HTTP/2 implementation. Oracle has not published packet-level details, but the vulnerability is similar to earlier HTTP/2 denial of service issues in WebLogic Server, such as CVE-2025-21549. An attacker sends malformed or specially crafted HTTP/2 frames, and those frames trigger a hang or crash in the server's core processing logic. The result can be a complete denial of service, with manual intervention or automated recovery needed to bring the service back.
No public code snippets or packet structures have been disclosed for this vulnerability. The issue affects HTTP/2 protocol handling only and does not affect other protocols or components.
Affected Systems and Versions
- Oracle WebLogic Server 14.1.1.0.0
- Oracle WebLogic Server 14.1.2.0.0
Only these versions are confirmed as affected. The vulnerability is present when the HTTP/2 protocol is enabled and reachable over the network. The available advisories do not list other versions or configurations as affected.
Vendor Security History
Oracle has a documented history of protocol-related vulnerabilities in WebLogic Server. Recent examples include:
- CVE-2025-21549: HTTP/2 denial of service in WebLogic Server 14.1.1.0.0 (January 2025 CPU)
- CVE-2025-21535: Remote code execution via T3/IIOP in WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (January 2025 CPU)
Oracle issues quarterly Critical Patch Updates (CPUs) and has responded to active exploitation before, as it did with CVE-2025-61882 in Oracle E-Business Suite. Some protocol vulnerabilities have needed more than one update before the related issues were fully fixed.
