Unrated severityOSV Advisory· Published Apr 15, 2025· Updated Apr 15, 2025
PeerTube User Import Authenticated Persistent Denial of Service
CVE-2025-32944
Description
The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. If the yauzl library encounters a filename that is considered illegal, it raises an exception that is uncaught by PeerTube, leading to a crash which repeats infinitely on startup.
Affected products
1- Range: v0.0.11-alpha, v0.0.12-alpha, v0.0.13-alpha, …
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1mitrepatch
- research.jfrog.com/vulnerabilities/peertube-archive-persistent-dos/mitrethird-party-advisory
News mentions
0No linked articles in our index yet.