CVE-2025-55128 Denial of service in Revive Adserver

Medium 6.5 Published 20 Nov 2025 Updated 2 Dec 2025

An attacker with admin access can cause denial of service by requesting an arbitrarily large number of items per page in the user log index.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-55128?

CVE-2025-55128 is a medium-severity denial of service vulnerability in Revive Adserver, published on 20 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php”. An attacker with access to the admin interface could request an arbitrarily large number of items per page, potentially leading to a denial of service.

Weakness: CWE-400

Which versions are affected by CVE-2025-55128?

It affects 1 product.

Products include Aquaplatform Revive Adserver.

How do I fix CVE-2025-55128?

No fix has been published for CVE-2025-55128 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-55128 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55128 exists.

Sources

Also known as GHSA-99fr-mxgj-j98p.