CVE-2025-68475
🟡 Monitoruj
Podatność w Fedify umożliwia atak Denial of Service (DoS) poprzez złośliwe HTML, co prowadzi do przeciążenia serwera.
CVSS
7.5
EPSS
0.6%
Exploit
poc
Vendor
fedify
Opis źródłowy (NVD)
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.
dos exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.5 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.6% |
| Opublikowano (NVD) | 2025-12-22 22:16:09 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-28 10:10:00 UTC |
Referencje
- https://github.com/fedify-dev/fedify/commit/2bdcb24d7d6d5886e0214ed504b63a6dc5488779 ([email protected]) [Patch]
- https://github.com/fedify-dev/fedify/commit/bf2f0783634efed2663d1b187dc55461ee1f987a ([email protected]) [Patch]
- https://github.com/fedify-dev/fedify/releases/tag/1.6.13 ([email protected]) [Product, Release Notes]
- https://github.com/fedify-dev/fedify/releases/tag/1.7.14 ([email protected]) [Product, Release Notes]
- https://github.com/fedify-dev/fedify/releases/tag/1.8.15 ([email protected]) [Product, Release Notes]
- https://github.com/fedify-dev/fedify/releases/tag/1.9.2 ([email protected]) [Product, Release Notes]
- https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93 ([email protected]) [Exploit, Mitigation, Vendor Advisory]