PT-2025-16344 · Peertube · Peertube

Ori Hollander · Published 2025-04-15 · Updated 2025-10-21 · CVE-2025-32947

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PeerTube (affected versions not specified)

Description This issue allows an attacker to cause the PeerTube server to become unresponsive due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities. The estimated number of potentially affected devices worldwide is not available. Details about real-world incidents where this issue was exploited are not provided. The issue is related to the /inbox API endpoint, where an infinite loop can occur when processing certain ActivityPub activities.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2025-32947

Affected Products

Peertube

References · 11

• 🔥 https://research.jfrog.com/vulnerabilities/peertube-activitypub-crawl-dos · Exploit
• https://github.com/Chocobozzz/PeerTube/commit/76226d85685220db1495025300eca784d0336f7d · Patch
• https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-32947 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32947 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1912180793348100305 · Twitter Post
• https://t.me/cveNotify/139642 · Telegram Post
• https://t.me/cveNotify/132877 · Telegram Post
• https://t.me/cvetracker/21640 · Telegram Post
• https://twitter.com/CVEnew/status/1912157345616138440 · Twitter Post
• https://t.me/cvedetector/22974 · Telegram Post