CVE-2025-32947

7.5 highEPSS 0.8%

High (7.5) in framasoft peertube. EPSS 0.8% chance of exploitation in the next 30 days.

This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-835
Published: 2025-04-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

framasoft:peertube

References

https://github.com/Chocobozzz/PeerTube/commit/76226d85685220db1495025300eca784d0336f7d
https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1
https://research.jfrog.com/vulnerabilities/peertube-activitypub-crawl-dos/

Check your stack JSON