CVSS 4.0
8.7 highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NCVE-2025-6998
High (8.7). EPSS 1.0% chance of exploitation in the next 30 days.
ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1333
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2g7m-ph9x-7q7m | PyPI | calibreweb | <=0.6.24 | no fix published |
| PYSEC-2026-1228 | PyPI | calibreweb | <=0.6.24 | no fix published |