@fedify@hollo.social
🚨 Security Advisory: CVE-2025-68475
A ReDoS (Regular Expression Denial of Service) vulnerability has been discovered in Fedify's HTML parsing code. This vulnerability could allow a malicious federated server to cause denial of service by sending specially crafted HTML responses.
| CVE ID | CVE-2025-68475 |
| Severity | High (CVSS 7.5) |
| Affected versions | ≤1.9.1 |
| Patched versions | 1.6.13, 1.7.14, 1.8.15, 1.9.2 |
If you're running Fedify in production, please upgrade to one of the patched versions immediately.
For full details, see the security advisory: https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93
Thank you to Yue (Knox) Liu for responsibly reporting this vulnerability.
github.com
ReDoS Vulnerability in HTML Parsing Regex
Hi Fedify team! 👋 Thank you for your work on Fedify—it's a fantastic library for building federated applications. While reviewing the codebase, I discovered a Regular Expression Denial of Servic...