PT-2025-12367 · Redlib · Redlib

Published 2025-03-20 · Updated 2026-02-03 · CVE-2025-30160

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Redlib versions prior to 0.36.0

Description A denial-of-service condition can be triggered by submitting a specially crafted base2048-encoded DEFLATE decompression bomb to the restore preferences form, leading to excessive memory consumption and potential system instability. This can disrupt Redlib instances.

Recommendations For versions prior to 0.36.0, update to version 0.36.0 to resolve the issue. As a temporary workaround, consider restricting access to the restore preferences form to minimize the risk of exploitation.

Exploit

Fix

DoS

Resource Exhaustion

Deserialization of Untrusted Data

Weakness Enumeration

CWE-400

CWE-502

Related Identifiers

CVE-2025-30160

GHSA-G8VQ-V3MG-7MRG

Affected Products

Redlib

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30160.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-30160 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30160 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g8vq-v3mg-7mrg · Vendor Advisory
• https://github.com/redlib-org/redlib/commit/15147cea8e42f6569a11603d661d71122f6a02dc · Note
• https://github.com/redlib-org/redlib/commit/2e95e1fc6e2064ccfae87964b4860bda55eddb9a · Note
• https://github.com/redlib-org/redlib/security/advisories/GHSA-g8vq-v3mg-7mrg · Note
• https://github.com/redlib-org/redlib · Note
• https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p · Note
• https://t.me/latest_high_impact_cve/2013 · Telegram Post
• https://twitter.com/CVEnew/status/1902816441323135256 · Twitter Post
• https://twitter.com/bluepinksec/status/1902978939410321529 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1903142137199308993 · Twitter Post
• https://t.me/cveNotify/150747 · Telegram Post
• https://t.me/cvedetector/20761 · Telegram Post