{"id":"GHSA-m494-w24q-6f7w","summary":"JDBC Driver for SQL Server has improper input validation issue","details":"Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.","aliases":["CVE-2025-59250"],"modified":"2026-07-17T21:05:13.385690345Z","published":"2025-10-14T18:30:35Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2025-11-03T14:53:13Z","nvd_published_at":"2025-10-14T17:16:07Z","cwe_ids":["CWE-20"],"severity":"HIGH"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59250"},{"type":"WEB","url":"https://github.com/microsoft/mssql-jdbc/pull/2798"},{"type":"WEB","url":"https://github.com/microsoft/mssql-jdbc/pull/2800"},{"type":"WEB","url":"https://github.com/microsoft/mssql-jdbc/pull/2801"},{"type":"WEB","url":"https://github.com/microsoft/mssql-jdbc/pull/2802"},{"type":"WEB","url":"https://github.com/microsoft/mssql-jdbc/pull/2803"},{"type":"WEB","url":"https://github.com/microsoft/mssql-jdbc/pull/2807"},{"type":"WEB","url":"https://github.com/microsoft/mssql-jdbc/commit/9732e1bbc6ec44166fda2cddab31ce1c86c873dd#diff-45367b99a1951943bfecfc7765e80df687967aa56286a5b2e039f77cd9a0e118"},{"type":"PACKAGE","url":"https://github.com/microsoft/mssql-jdbc"},{"type":"WEB","url":"https://github.com/microsoft/mssql-jdbc/blob/main/CHANGELOG.md"},{"type":"WEB","url":"https://learn.microsoft.com/en-us/sql/connect/jdbc/microsoft-jdbc-driver-for-sql-server-support-matrix"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250"}],"affected":[{"package":{"name":"com.microsoft.sqlserver:mssql-jdbc","ecosystem":"Maven","purl":"pkg:maven/com.microsoft.sqlserver/mssql-jdbc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.0.jre11-preview"},{"fixed":"10.2.4.jre11"}]}],"versions":["10.1.0.jre11-preview","10.1.0.jre17-preview","10.1.0.jre8-preview","10.2.0-SNAPSHOT.jre11-preview","10.2.0-SNAPSHOT.jre17-preview","10.2.0-SNAPSHOT.jre8-preview","10.2.0.jre11","10.2.0.jre17","10.2.0.jre8","10.2.1.jre11","10.2.1.jre17","10.2.1.jre8","10.2.2.jre11","10.2.2.jre11-preview","10.2.2.jre17","10.2.2.jre17-preview","10.2.2.jre8","10.2.2.jre8-preview","10.2.3.jre11","10.2.3.jre17","10.2.3.jre8","10.2.4.jre8","8.3.0.jre11-preview","8.3.0.jre14-preview","8.3.1.jre11-preview","8.3.1.jre14-preview","8.3.1.jre8-preview","8.4.0.jre11","8.4.0.jre14","8.4.0.jre8","8.4.1.jre11","8.4.1.jre14","8.4.1.jre8","9.1.0.jre11-preview","9.1.0.jre15-preview","9.1.0.jre8-preview","9.1.1.jre11-preview","9.1.1.jre15-preview","9.1.1.jre8-preview","9.2.0.jre11","9.2.0.jre15","9.2.0.jre8","9.2.1.jre11","9.2.1.jre15","9.2.1.jre8","9.3.0.jre11-preview","9.3.0.jre15-preview","9.3.0.jre8-preview","9.3.1.jre11-preview","9.3.1.jre15-preview","9.3.1.jre8-preview","9.4.0.jre11","9.4.0.jre16","9.4.0.jre8","9.4.1.jre11","9.4.1.jre11-preview","9.4.1.jre16","9.4.1.jre16-preview","9.4.1.jre8","9.4.1.jre8-preview","9.5.0-SNAPSHOT.jre11-preview","9.5.0-SNAPSHOT.jre17-preview","9.5.0-SNAPSHOT.jre8-preview","9.5.0.jre11-preview","9.5.0.jre17-preview","9.5.0.jre8-preview"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-m494-w24q-6f7w/GHSA-m494-w24q-6f7w.json"}},{"package":{"name":"com.microsoft.sqlserver:mssql-jdbc","ecosystem":"Maven","purl":"pkg:maven/com.microsoft.sqlserver/mssql-jdbc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.0.jre11"},{"fixed":"11.2.4.jre11"}]}],"versions":["11.2.0.jre11","11.2.0.jre17","11.2.0.jre18","11.2.1.jre11","11.2.1.jre17","11.2.1.jre18","11.2.1.jre8","11.2.2.jre11","11.2.2.jre17","11.2.2.jre18","11.2.2.jre8","11.2.3.jre11","11.2.3.jre17","11.2.3.jre18","11.2.3.jre8","11.2.4.jre8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-m494-w24q-6f7w/GHSA-m494-w24q-6f7w.json"}},{"package":{"name":"com.microsoft.sqlserver:mssql-jdbc","ecosystem":"Maven","purl":"pkg:maven/com.microsoft.sqlserver/mssql-jdbc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.2.0.jre11"},{"fixed":"12.2.1.jre11"}]}],"versions":["12.2.0.jre11","12.2.1.jre8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-m494-w24q-6f7w/GHSA-m494-w24q-6f7w.json"}},{"package":{"name":"com.microsoft.sqlserver:mssql-jdbc","ecosystem":"Maven","purl":"pkg:maven/com.microsoft.sqlserver/mssql-jdbc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.6.0.jre11"},{"fixed":"12.6.5.jre11"}]}],"versions":["12.6.0.jre11","12.6.1.jre11","12.6.1.jre8","12.6.2.jre11","12.6.2.jre8","12.6.3.jre11","12.6.3.jre8","12.6.4.jre11","12.6.4.jre8","12.6.5.jre8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-m494-w24q-6f7w/GHSA-m494-w24q-6f7w.json"}},{"package":{"name":"com.microsoft.sqlserver:mssql-jdbc","ecosystem":"Maven","purl":"pkg:maven/com.microsoft.sqlserver/mssql-jdbc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.8.0.jre11"},{"fixed":"12.8.2.jre11"}]}],"versions":["12.8.0.jre11","12.8.1.jre11","12.8.1.jre8","12.8.2.jre8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-m494-w24q-6f7w/GHSA-m494-w24q-6f7w.json"}},{"package":{"name":"com.microsoft.sqlserver:mssql-jdbc","ecosystem":"Maven","purl":"pkg:maven/com.microsoft.sqlserver/mssql-jdbc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.10.0.jre11"},{"fixed":"12.10.2.jre11"}]}],"versions":["12.10.0.jre11","12.10.1.jre11","12.10.1.jre8","12.10.2.jre8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-m494-w24q-6f7w/GHSA-m494-w24q-6f7w.json"}},{"package":{"name":"com.microsoft.sqlserver:mssql-jdbc","ecosystem":"Maven","purl":"pkg:maven/com.microsoft.sqlserver/mssql-jdbc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0.jre11"},{"fixed":"13.2.1.jre11"}]}],"versions":["13.2.0.jre11","13.2.1.jre8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-m494-w24q-6f7w/GHSA-m494-w24q-6f7w.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}]}