CVE-2025-0588 Denial of service in Octopus Server
An authenticated user can cause a persistent denial of service by injecting a crafted referrer header that triggers 500 errors on all server responses.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0588?
CVE-2025-0588 is a medium-severity denial of service vulnerability in Octopus Octopus Server, published on 11 Feb 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly unusable. The user would be able to subsequently set and unset the referrer header to control the denial of service state with a valid CSRF token whilst new CSRF tokens could not be generated.
Weakness: CWE-113
Which versions are affected by CVE-2025-0588?
It affects 1 product.
Products include Octopus Octopus Server.
How do I fix CVE-2025-0588?
No fix has been published for CVE-2025-0588 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-0588 being exploited?
There is no known exploitation of CVE-2025-0588 in the wild and no public exploit code.
Other vulnerabilities in Octopus Octopus Server
Sources
Also known as GHSA-8w92-pvrp-jcwv.