CVE-2025-3985

Summary

CVE-2025-3985 is a newly disclosed vulnerability affecting Apereo CAS 5.2.6. This issue, classified as problematic, targets the ResponseEntity function in the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\ManageRegisteredServicesMultiActionController.java. The manipulation of the Query argument results in inefficient regular expression complexity, allowing remote attackers to initiate the exploit. The vendor was contacted about the disclosure but did not respond, leaving the public open to potential exploitation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.