CVE-2025-31990
HCL DevOps Velocity is susceptible to a Denial of Service vulnerability
- State
- Published
- Severity
- 6.8 Medium
- Published
- Feb 7, 2026
- Updated
- Feb 9, 2026
- Reserved
- Apr 1, 2025
Description
Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability is fixed in 5.1.7.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H | HCL |
Weaknesses
- CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products
| Product | Versions |
|---|---|
HCL DevOps VelocityHCLSoftware |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.