CVE-2025-39799: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-3x2h-jpxc-pv8r
Share
Published
Advisory Summary

CVE-2025-39799 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2025-39799 at a Glance

CVE Identifier CVE-2025-39799
GHSA Identifier GHSA-3x2h-jpxc-pv8r
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2025-39799

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2025-39799, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: perflib: Move problematic pr->performance check Commit d33bd88ac0eb ("ACPI: processor: perflib: Fix initial _PPC limit application") added a pr->performance check that prevents the frequency QoS request from being added when the given processor has no performance object. Unfortunately, this causes a WARN() in freq_qos_remove_request() to trigger on an attempt to take the given CPU offline later because the frequency QoS object has not been added for it due to the missing performance object. Address this by moving the pr->performance check before calling acpi_processor_get_platform_limit() so it only prevents a limit from being set for the CPU if the performance object is not present. This way, the frequency QoS request is added as it was before the above commit and it is present all the time along with the CPU's cpufreq policy regardless of whether or not the CPU is online.

References

NVD — CVE-2025-39799 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-39799
git.kernel.org/stable/c/19849010c9... WEB
https://git.kernel.org/stable/c/19849010c9e18d54375091864a3313fc328d6186
git.kernel.org/stable/c/31ee723d6f... WEB
https://git.kernel.org/stable/c/31ee723d6fc581b76396994a96b85be3e87f67d6
git.kernel.org/stable/c/8972d7dbda... WEB
https://git.kernel.org/stable/c/8972d7dbdac029c9dbf62a45d7d8c71999785765
git.kernel.org/stable/c/bf28095414... WEB
https://git.kernel.org/stable/c/bf2809541497749c4f2646b87bf75244f5a2a5d9
git.kernel.org/stable/c/cb4b5f4a1e... WEB
https://git.kernel.org/stable/c/cb4b5f4a1e778f6a20d06d4eda6842714a817618
git.kernel.org/stable/c/d405ec23df... WEB
https://git.kernel.org/stable/c/d405ec23df13e6df599f5bd965a55d13420366b8
git.kernel.org/stable/c/edc065c192... WEB
https://git.kernel.org/stable/c/edc065c19257adfd9c356178dac021df661e169e
git.kernel.org/stable/c/fc36403e74... WEB
https://git.kernel.org/stable/c/fc36403e741d7674a44632313db33fa7605cb2b4
git.kernel.org/stable/c/fd9cad6b06... WEB
https://git.kernel.org/stable/c/fd9cad6b0676e0bb3a98ee0a8865a86e2f53eb07

Frequently Asked Questions

What is CVE-2025-39799?
CVE-2025-39799 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2025-39799?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2025-39799?
CVE-2025-39799 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2025-39799?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3x2h-jpxc-pv8r",
  "modified" : "2025-09-12T18:31:10Z",
  "published" : "2025-09-12T18:31:10Z",
  "aliases" : [ "CVE-2025-39799" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: processor: perflib: Move problematic pr->performance check\n\nCommit d33bd88ac0eb (\"ACPI: processor: perflib: Fix initial _PPC limit\napplication\") added a pr->performance check that prevents the frequency\nQoS request from being added when the given processor has no performance\nobject.  Unfortunately, this causes a WARN() in freq_qos_remove_request()\nto trigger on an attempt to take the given CPU offline later because the\nfrequency QoS object has not been added for it due to the missing\nperformance object.\n\nAddress this by moving the pr->performance check before calling\nacpi_processor_get_platform_limit() so it only prevents a limit from\nbeing set for the CPU if the performance object is not present.  This\nway, the frequency QoS request is added as it was before the above\ncommit and it is present all the time along with the CPU's cpufreq\npolicy regardless of whether or not the CPU is online.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-39799"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/19849010c9e18d54375091864a3313fc328d6186"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/31ee723d6fc581b76396994a96b85be3e87f67d6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8972d7dbdac029c9dbf62a45d7d8c71999785765"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bf2809541497749c4f2646b87bf75244f5a2a5d9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cb4b5f4a1e778f6a20d06d4eda6842714a817618"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d405ec23df13e6df599f5bd965a55d13420366b8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/edc065c19257adfd9c356178dac021df661e169e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fc36403e741d7674a44632313db33fa7605cb2b4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fd9cad6b0676e0bb3a98ee0a8865a86e2f53eb07"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2025-09-12T16:15:34Z"
  }
}