CVE-2025-42895: Code Loading in SAP HANA JDBC Client
Platform
java
Component
sap-hana-jdbc-client
Fixed in
2.0.1
CVE-2025-42895 affects the SAP HANA JDBC Client, specifically versions 2.0–HDB_CLIENT 2.0. This vulnerability stems from insufficient validation of connection property values, enabling a local, high-privilege user to potentially load unauthorized code. The impact primarily affects the availability of the application, though confidentiality and integrity are also at risk. The vulnerability was published on November 11, 2025, and a fix is available in version 2.0.1.
Detect this CVE in your project
Upload your pom.xml file and we'll tell you instantly if you're affected.
Impact and Attack Scenarios
An attacker exploiting CVE-2025-42895 could leverage their high-privilege local access to craft malicious connection property parameters. These parameters, due to the lack of proper validation, could be used to load arbitrary code into the SAP HANA JDBC Client process. Successful exploitation could lead to a denial-of-service (DoS) condition, rendering the application unavailable. While the direct impact on confidentiality and integrity is considered low, the ability to execute code within the client process opens the door to further attacks, potentially allowing an attacker to escalate privileges or exfiltrate sensitive data stored within the SAP HANA database. The blast radius extends to any application relying on the vulnerable JDBC client to connect to the SAP HANA database.
Exploitation Context
The exploitation context for CVE-2025-42895 is currently unclear. No public proof-of-concept (POC) code has been released. The vulnerability's severity is rated as medium, suggesting a moderate probability of exploitation. It is not listed on the KEV catalog or EPSS. Further monitoring of security advisories and threat intelligence feeds is recommended to assess the evolving risk.
Threat Intelligence
Exploit Status
EPSS
0.03% (10% percentile)
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Local — attacker needs a local shell or interactive session on the system.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- High — admin or privileged account required to exploit.
- User Interaction
- Required — victim must take an action: open a file, click a link, or visit a crafted page.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- Low — partial or indirect data access. Attacker gains limited information.
- Integrity
- Low — attacker can modify some data with limited scope or impact.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2025-42895 is to upgrade the SAP HANA JDBC Client to version 2.0.1 or later. If an immediate upgrade is not feasible, consider implementing stricter access controls to limit the privileges of local users. Review and restrict connection property configurations to prevent the injection of malicious parameters. While a direct WAF rule is unlikely to be effective, monitoring network traffic for unusual connection attempts or code loading activity could provide early warning signs. After upgrading, confirm the fix by attempting to establish a connection with crafted parameters known to trigger the vulnerability; the connection should fail with an appropriate error message.
How to fix
Actualice el SAP HANA JDBC Client a la última versión disponible proporcionada por SAP. Consulte la nota SAP 3643385 para obtener más detalles e instrucciones específicas sobre la actualización.
Frequently asked questions
What is CVE-2025-42895 — Code Loading in SAP HANA JDBC Client?
CVE-2025-42895 is a medium severity vulnerability in the SAP HANA JDBC Client (versions 2.0–HDB_CLIENT 2.0) that allows a local, high-privilege user to load unauthorized code due to insufficient validation, impacting application availability.
Am I affected by CVE-2025-42895 in SAP HANA JDBC Client?
You are affected if you are using SAP HANA JDBC Client versions 2.0–HDB_CLIENT 2.0. Check your system's version and upgrade if necessary.
How do I fix CVE-2025-42895 in SAP HANA JDBC Client?
Upgrade the SAP HANA JDBC Client to version 2.0.1 or later to resolve the vulnerability. If immediate upgrade is not possible, restrict access controls and review connection property configurations.
Is CVE-2025-42895 being actively exploited?
Currently, there is no public evidence of active exploitation. However, the vulnerability's severity warrants ongoing monitoring and proactive mitigation.
Where can I find the official SAP advisory for CVE-2025-42895?
Refer to the official SAP Security Notes and Advisories for detailed information and guidance regarding CVE-2025-42895. Check the SAP Support Portal for the latest updates.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your pom.xml file and we'll tell you instantly if you're affected.
Scan your Java / Maven project now — no account
Upload your pom.xml and get the vulnerability report instantly. No account. Uploading the file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...