← Back

CVE-2025-68148

nvd nist
Published: Dec 27, 2025Modified: Dec 31, 2025

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.

Affected (1)

Products: Freshrss: Freshrss
Freshrss
1 product
Freshrss
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Freshrss
From 1.27.0 to 1.28.0

Related CWEs

CWE-770
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Issue Tracking
Source: security-advisories@github.com
ExploitPatchVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitPatchVendor Advisory

Timeline

No history available yet.