{"action":"Upgrade com.microsoft.sqlserver:mssql-jdbc to the fixed version for your line (see fixed_versions).","affected":[{"fixed":"10.2.4.jre11","introduced":"8.3.0.jre11-preview"},{"fixed":"11.2.4.jre11","introduced":"11.2.0.jre11"},{"fixed":"12.2.1.jre11","introduced":"12.2.0.jre11"},{"fixed":"12.6.5.jre11","introduced":"12.6.0.jre11"},{"fixed":"12.8.2.jre11","introduced":"12.8.0.jre11"},{"fixed":"12.10.2.jre11","introduced":"12.10.0.jre11"},{"fixed":"13.2.1.jre11","introduced":"13.2.0.jre11"}],"component":"com.microsoft.sqlserver:mssql-jdbc","cve_ids":["CVE-2025-59250"],"ecosystem":"Maven","epss":0.00735,"exploited":false,"fixed_versions":["10.2.4.jre11","11.2.4.jre11","12.2.1.jre11","12.6.5.jre11","12.8.2.jre11","12.10.2.jre11","13.2.1.jre11"],"ghsa_id":"GHSA-m494-w24q-6f7w","id":"tcs_01M5N9486AKBTYVV3KDNZ3J5DG","modified_at":"2026-09-10T03:50:30.361235849Z","published_at":"2025-10-14T18:30:35Z","references":["https://osv.dev/vulnerability/GHSA-m494-w24q-6f7w","https://nvd.nist.gov/vuln/detail/CVE-2025-59250","https://github.com/microsoft/mssql-jdbc/pull/2798","https://github.com/microsoft/mssql-jdbc/pull/2800","https://github.com/microsoft/mssql-jdbc/pull/2801","https://github.com/microsoft/mssql-jdbc/pull/2802","https://github.com/microsoft/mssql-jdbc/pull/2803","https://github.com/microsoft/mssql-jdbc/pull/2807","https://github.com/microsoft/mssql-jdbc/commit/9732e1bbc6ec44166fda2cddab31ce1c86c873dd#diff-45367b99a1951943bfecfc7765e80df687967aa56286a5b2e039f77cd9a0e118","https://github.com/microsoft/mssql-jdbc","https://github.com/microsoft/mssql-jdbc/blob/main/CHANGELOG.md","https://learn.microsoft.com/en-us/sql/connect/jdbc/microsoft-jdbc-driver-for-sql-server-support-matrix","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-m494-w24q-6f7w","url":"https://osv.dev/vulnerability/GHSA-m494-w24q-6f7w"}],"summary":"JDBC Driver for SQL Server has improper input validation issue"}