CVE-2025-39801: Software Security Vulnerability Vulnerability

MODERATE
Advisory Identifier: GHSA-2qcc-gm3c-qcf7
Share
CVSS 5.5
CWE-617
Published
Advisory Summary

CVE-2025-39801 is a MODERATE (CVSS 5.5) security vulnerability vulnerability (CWE-617: Reachable Assertion) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.. Remediation is available in the latest vendor maintenance releases.

CVE-2025-39801 at a Glance

CVE Identifier CVE-2025-39801
GHSA Identifier GHSA-2qcc-gm3c-qcf7
Severity MODERATE
CVSS v3.1 Base Score 5.5
CWE Classification CWE-617: Reachable Assertion
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 5.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2025-39801

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2025-39801, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-617: Reachable Assertion, where the product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'panic_on_warn' is enabled and unnecessary call trace prints when 'panic_on_warn' is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed: 1. Connect ======= ->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup ->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data ->dwc3_send_gadget_ep_cmd 2. Disconnect ========== ->dwc3_thread_interrupt ->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data ->dwc3_send_gadget_ep_cmd In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn.

References

NVD — CVE-2025-39801 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-39801
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-032379.html
git.kernel.org/stable/c/45eae113dc... WEB
https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f
git.kernel.org/stable/c/5a1a847d84... WEB
https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8
git.kernel.org/stable/c/84c95dbf5b... WEB
https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9
git.kernel.org/stable/c/db27482b9d... WEB
https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2
git.kernel.org/stable/c/dfe40159ee... WEB
https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f
git.kernel.org/stable/c/f49697dfba... WEB
https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929
lists.debian.org/debian-lts-announce... WEB
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Frequently Asked Questions

What is CVE-2025-39801?
CVE-2025-39801 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-617: Reachable Assertion.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2025-39801?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2025-39801?
CVE-2025-39801 has a CVSS v3.1 base score of 5.5 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2025-39801?
CVE-2025-39801 is classified under CWE-617: Reachable Assertion (The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.).
How can I check Maven dependencies for CVE-2025-39801?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2qcc-gm3c-qcf7",
  "modified" : "2026-05-12T15:31:08Z",
  "published" : "2025-09-15T15:31:21Z",
  "aliases" : [ "CVE-2025-39801" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Remove WARN_ON for device endpoint command timeouts\n\nThis commit addresses a rarely observed endpoint command timeout\nwhich causes kernel panic due to warn when 'panic_on_warn' is enabled\nand unnecessary call trace prints when 'panic_on_warn' is disabled.\nIt is seen during fast software-controlled connect/disconnect testcases.\nThe following is one such endpoint command timeout that we observed:\n\n1. Connect\n   =======\n->dwc3_thread_interrupt\n ->dwc3_ep0_interrupt\n  ->configfs_composite_setup\n   ->composite_setup\n    ->usb_ep_queue\n     ->dwc3_gadget_ep0_queue\n      ->__dwc3_gadget_ep0_queue\n       ->__dwc3_ep0_do_control_data\n        ->dwc3_send_gadget_ep_cmd\n\n2. Disconnect\n   ==========\n->dwc3_thread_interrupt\n ->dwc3_gadget_disconnect_interrupt\n  ->dwc3_ep0_reset_state\n   ->dwc3_ep0_end_control_data\n    ->dwc3_send_gadget_ep_cmd\n\nIn the issue scenario, in Exynos platforms, we observed that control\ntransfers for the previous connect have not yet been completed and end\ntransfer command sent as a part of the disconnect sequence and\nprocessing of USB_ENDPOINT_HALT feature request from the host timeout.\nThis maybe an expected scenario since the controller is processing EP\ncommands sent as a part of the previous connect. It maybe better to\nremove WARN_ON in all places where device endpoint commands are sent to\navoid unnecessary kernel panic due to warn.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-39801"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/db27482b9db340402e05d4e9b75352bbaca51af2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dfe40159eec6ca63b40133bfa783eee2e3ed829f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f49697dfba2915a9ff36f94604eb76fa61413929"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-617" ],
    "severity" : "MODERATE",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2025-09-15T13:15:35Z"
  }
}