CVE-2025-32947CWE-835

PeerTube ActivityPub Crawl Infinite Loop DoS

High · published April 15, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00759 · 54.8th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2025-04-15T14:45Z
EPSS history
Timeline
  • 15 APR 14:45Z
    PeerTube ActivityPub Crawl Infinite Loop DoS
    cvelistv5