CVE-2025-32944 PeerTube User Import Authenticated Persistent Denial of Service

Medium 6.5 Published 15 Apr 2025 Updated 15 Apr 2025

Authenticated users can crash PeerTube servers persistently by uploading archives with illegal filenames, requiring a patch to handle exceptions correctly.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-32944?

CVE-2025-32944 is a medium-severity denial of service vulnerability in framasoft:peertube, published on 15 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. If the yauzl library encounters a filename that is considered illegal, it raises an exception that is uncaught by PeerTube, leading to a crash which repeats infinitely on startup.

Weakness: CWE-248

Which versions are affected by CVE-2025-32944?

It affects 1 product.

Products include Framasoft Peertube.

How do I fix CVE-2025-32944?

No fix has been published for CVE-2025-32944 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-32944 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-32944 exists.

Sources

Also known as GHSA-fvpc-gqmr-784w.