CVE-2025-41075 Multiple vulnerabilities in Limesurvey
An attacker can cause a Denial of Service in LimeSurvey by triggering infinite HTTP redirects on the /optin endpoint, exhausting server or client resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-41075?
CVE-2025-41075 is a medium-severity denial of service vulnerability in Limesurvey Limesurvey, published on 20 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability.
Weakness: CWE-835
Which versions are affected by CVE-2025-41075?
1 open source package ship an affected version, including limesurvey. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
limesurvey Bitnami | From 6.13.0 | 6.15.5 |
Products include Limesurvey Limesurvey.
How do I fix CVE-2025-41075?
Upgrade limesurvey to 6.15.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-41075 being exploited?
There is no known exploitation of CVE-2025-41075 in the wild and no public exploit code.
Other vulnerabilities in Limesurvey Limesurvey
Sources
Also known as BIT-limesurvey-2025-41075, GHSA-46hr-8mq3-w232.