CVE-2025-68148

Katalog CVE

CVSS 7.5 · High EPSS 0,43%

Kerentanan Allocation of Resources Without Limits or Throttling pada freshrss. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.

Rincian

Terbit di NVD

27 Desember 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78 exploit · patch · advisory vendor
• https://github.com/FreshRSS/FreshRSS/commit/7d4854a0a4f5665db599f18c34035786465639f3 patch
• https://github.com/FreshRSS/FreshRSS/pull/8029 issue tracking