CVE-2025-61582 Ts3 Manager: Unauthenticated Denial of Service possible through specially crafted Unicode input
Unauthenticated attackers can crash the TS3 Manager web interface by submitting specially crafted Unicode input to the login page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-61582?
CVE-2025-61582 is a high-severity denial of service vulnerability in joni1802 ts3-manager, published on 1 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability permits an unauthenticated actor to crash the application through the submission of specially crafted Unicode input, requiring no prior authentication or privileges. The flaw manifests when Unicode tag characters are submitted to the Server field on the login page. The application fails to properly handle these characters during the ASCII conversion process, resulting in an unhandled exception that terminates the application within four to five seconds of submission. This issue is fixed in version 2.2.2.
Weakness: CWE-20
Which versions are affected by CVE-2025-61582?
It affects 1 product.
Products include Joni1802 Ts3 Manager.
How do I fix CVE-2025-61582?
No fix has been published for CVE-2025-61582 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-61582 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61582 exists.
Other vulnerabilities in joni1802 ts3-manager
Sources
Also known as GHSA-4cq4-hp4f-8w7p.