CVE-2025-68148

FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/FreshRSS/FreshRSS/commit/7d4854a0a4f5665db599f18c34035786465639f3	Patch
https://github.com/FreshRSS/FreshRSS/pull/8029	Issue Tracking
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78	Exploit Patch Vendor Advisory
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*

History

13 Oct 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) FreshRSS es un agregador RSS gratuito y autoalojable. Desde la versión 1.27.0 hasta antes de la 1.28.0, un atacante podría denegar globalmente el acceso a las fuentes, modificando a 429 Retry-After a través de un proxy para una gran lista de fuentes en una instancia determinada, lo que la hacía inutilizable para la mayoría de los usuarios. Este problema ha sido parcheado en la versión 1.28.0.

Information

Published : 2025-12-27 00:15

Updated : 2026-10-13 09:10

NVD link : CVE-2025-68148

Mitre link : CVE-2025-68148

CVE.ORG link : CVE-2025-68148

JSON object : View

Products Affected

freshrss

freshrss

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-68148", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68148", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-29T16:44:23.192830Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FreshRSS", "product": "FreshRSS", "versions": [{"status": "affected", "version": ">= 1.27.0, < 1.28.0"}]}]}], "published": "2025-12-27T00:15:42.167", "references": [{"url": "https://github.com/FreshRSS/FreshRSS/commit/7d4854a0a4f5665db599f18c34035786465639f3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/pull/8029", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0."}, {"lang": "es", "value": "FreshRSS es un agregador RSS gratuito y autoalojable. Desde la versi\u00f3n 1.27.0 hasta antes de la 1.28.0, un atacante podr\u00eda denegar globalmente el acceso a las fuentes, modificando a 429 Retry-After a trav\u00e9s de un proxy para una gran lista de fuentes en una instancia determinada, lo que la hac\u00eda inutilizable para la mayor\u00eda de los usuarios. Este problema ha sido parcheado en la versi\u00f3n 1.28.0."}], "lastModified": "2026-10-13T09:10:00.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78C074CB-5A8F-4811-8AFE-6CD10A20A88F", "versionEndExcluding": "1.28.0", "versionStartIncluding": "1.27.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}