A vulnerability, which was classified as problematic, was found in spdlog up to 1.15.1. This affects the function scoped_padder in the library include/spdlog/pattern_formatter-inl.h. The manipulation leads to resource consumption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.2 is able to address this issue. The identifier of the patch is 10320184df1eb4638e253a34b1eb44ce78954094. It is recommended to upgrade the affected component.

An update of the spdlog package has been released.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-7d5c7fe0c7 advisory.

    Backported the upstream CVE-2025-6140 fix.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241346	Photon OS 4.0: Spdlog PHSA-2025-4.0-0826	Nessus	PhotonOS Local Security Checks	medium
241237	Photon OS 5.0: Spdlog PHSA-2025-5.0-0547	Nessus	PhotonOS Local Security Checks	medium
240225	Fedora 41 : spdlog (2025-7d5c7fe0c7)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2025-6140

medium

Tenable Plugins

medium

medium

medium