CVE-2025-61601

BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a malicious payload with a massive array in the `answerIds` field, the attacker can cause the current meeting — and potentially all meetings on the server — to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/bigbluebutton/bigbluebutton/pull/23662	Issue Tracking Patch
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5	Exploit Vendor Advisory
https://www.youtube.com/watch?v=BwROSVIYjOY	Exploit
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5	Exploit Vendor Advisory
https://www.youtube.com/watch?v=BwROSVIYjOY	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) BigBlueButton es un aula virtual de código abierto. Una vulnerabilidad de denegación de servicio (DoS) en versiones anteriores a la 3.0.13 permite a cualquier usuario autenticado congelar o colapsar todo el servidor abusando del tipo de respuesta 'Choices' de la función de encuestas. Al enviar una carga útil maliciosa con un array masivo en el campo 'answerIds', el atacante puede causar que la reunión actual - y potencialmente todas las reuniones en el servidor - dejen de responder. La versión 3.0.13 contiene un parche. No hay soluciones alternativas conocidas disponibles.

Information

Published : 2025-10-09 21:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-61601

Mitre link : CVE-2025-61601

CVE.ORG link : CVE-2025-61601

JSON object : View

Products Affected

bigbluebutton

bigbluebutton

CWE

CWE-703

Improper Check or Handling of Exceptional Conditions

{"id": "CVE-2025-61601", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61601", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-15T19:47:11.105155Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "bigbluebutton", "product": "bigbluebutton", "versions": [{"status": "affected", "version": "< 3.0.13"}]}]}], "published": "2025-10-09T21:15:39.477", "references": [{"url": "https://github.com/bigbluebutton/bigbluebutton/pull/23662", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.youtube.com/watch?v=BwROSVIYjOY", "tags": ["Exploit"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.youtube.com/watch?v=BwROSVIYjOY", "tags": ["Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-703"}]}], "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a malicious payload with a massive array in the `answerIds` field, the attacker can cause the current meeting \u2014 and potentially all meetings on the server \u2014 to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available."}, {"lang": "es", "value": "BigBlueButton es un aula virtual de c\u00f3digo abierto. Una vulnerabilidad de denegaci\u00f3n de servicio (DoS) en versiones anteriores a la 3.0.13 permite a cualquier usuario autenticado congelar o colapsar todo el servidor abusando del tipo de respuesta 'Choices' de la funci\u00f3n de encuestas. Al enviar una carga \u00fatil maliciosa con un array masivo en el campo 'answerIds', el atacante puede causar que la reuni\u00f3n actual - y potencialmente todas las reuniones en el servidor - dejen de responder. La versi\u00f3n 3.0.13 contiene un parche. No hay soluciones alternativas conocidas disponibles."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AF3725E-941E-4C75-AA27-20DC97552948", "versionEndExcluding": "3.0.13"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}