CVE-2025-53634CWE-770

Chall-Manager's HTTP Gateway have no header check timeout leading to potential slow loris attacks

High · published July 10, 2025

CVSS v4.0
8.7
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a slow loris attack, an attacker could cause Denial of Service (DoS). Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 1385bd8 and shipped in v0.1.4.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00508 · 42.5th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-07-10T19:39Z
EPSS history
Timeline
  • 10 JUL 19:39Z
    Chall-Manager's HTTP Gateway have no header check timeout leading to potential slow loris attacks
    cvelistv5