PT-2025-53608 · Freshrss · Freshrss

Inverle · Published 2025-12-26 · Updated 2025-12-31 · CVE-2025-68148

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.27.0 through 1.27.9

Description An attacker could disrupt access to RSS feeds for all users of an instance by manipulating the proxy settings to send a large number of 429 Retry-After requests. This denial of service makes the application unusable for most users.

Recommendations Update to version 1.28.0 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-68148

GHSA-QW34-FRG7-GF78

Affected Products

Freshrss

References · 11

• 🔥 https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68148.json · Exploit
• https://github.com/FreshRSS/FreshRSS/commit/7d4854a0a4f5665db599f18c34035786465639f3 · Patch
• https://osv.dev/vulnerability/CVE-2025-68148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68148 · Security Note
• https://github.com/FreshRSS/FreshRSS/pull/8029 · Note
• https://t.me/cveNotify/146924 · Telegram Post
• https://t.me/CVEtracker/40733 · Telegram Post
• https://t.me/cveNotify/147404 · Telegram Post
• https://twitter.com/CVEnew/status/2004868109405245558 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2004719866775752826 · Twitter Post