GitHub Advisoryadvisory · Maven

GHSA-m494-w24q-6f7w JDBC Driver for SQL Server has improper input validation issue

HIGH Published 2025-10-14 Modified 2025-11-24 Official page ↗
Aliases
CVE-2025-59250
Ecosystem
Maven
Packages
com.microsoft.sqlserver:mssql-jdbc
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-20
Reviewed
2025-11-03

Affected packages

• Maven com.microsoft.sqlserver:mssql-jdbc: >= 8.3.0.jre11-preview, < 10.2.4.jre11 → fixed in 10.2.4.jre11 • Maven com.microsoft.sqlserver:mssql-jdbc: >= 11.2.0.jre11, < 11.2.4.jre11 → fixed in 11.2.4.jre11 • Maven com.microsoft.sqlserver:mssql-jdbc: >= 12.2.0.jre11, < 12.2.1.jre11 → fixed in 12.2.1.jre11 • Maven com.microsoft.sqlserver:mssql-jdbc: >= 12.6.0.jre11, < 12.6.5.jre11 → fixed in 12.6.5.jre11 • Maven com.microsoft.sqlserver:mssql-jdbc: >= 12.8.0.jre11, < 12.8.2.jre11 → fixed in 12.8.2.jre11 • Maven com.microsoft.sqlserver:mssql-jdbc: >= 12.10.0.jre11, < 12.10.2.jre11 → fixed in 12.10.2.jre11 • Maven com.microsoft.sqlserver:mssql-jdbc: >= 13.2.0.jre11, < 13.2.1.jre11 → fixed in 13.2.1.jre11

Description

Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

Related

Alias · CVE (1)

  • CVE-2025-59250 Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References