High severity7.5NVD Advisory· Published Oct 9, 2025· Updated Jun 17, 2026
CVE-2025-61601
CVE-2025-61601
Description
BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's Choices response type. By submitting a malicious payload with a massive array in the answerIds field, the attacker can cause the current meeting — and potentially all meetings on the server — to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*range: <3.0.13
- (no CPE)range: <3.0.13
- (no CPE)range: < 3.0.13
Patches
Vulnerability mechanics
References
3- github.com/bigbluebutton/bigbluebutton/pull/23662nvdIssue TrackingPatch
- github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5nvdExploitVendor Advisory
- www.youtube.com/watchnvdExploit
News mentions
0No linked articles in our index yet.