CVE-2025-29784 NamelessMC Has Lack of Length Validation for s Parameter in GET Requests

What is CVE-2025-29784?

CVE-2025-29784 is a high-severity denial of service vulnerability in NamelessMC Nameless, published on 18 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum search functionality lacks length validation, allowing attackers to submit excessively long search queries. This oversight can lead to performance degradation and potential denial-of-service (DoS) attacks. This issue has been patched in version 2.2.0.

Weakness: CWE-20, CWE-130, CWE-1284

Which versions are affected by CVE-2025-29784?

It affects 1 product.

Products include Namelessmc Nameless.

How do I fix CVE-2025-29784?

No fix has been published for CVE-2025-29784 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-29784 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29784 exists.

Other vulnerabilities in NamelessMC Nameless

• CVE-2022-2821 Missing Critical Step in Authentication in namelessmc/nameless Critical 9.8
• CVE-2025-54117 NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor Critical 9.1
• CVE-2025-22144 Account Takeover in NamelessMC Critical 9.0
• CVE-2025-32389 NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages High 8.6
• CVE-2025-30357 NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4hrq-rf96-c2jm.