CVE-2025-61601 BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation
Authenticated users can crash the BigBlueButton server by submitting a malicious GraphQL payload with a massive array in the polling feature.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-61601?
CVE-2025-61601 is a high-severity denial of service vulnerability in bigbluebutton, published on 9 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a malicious payload with a massive array in the `answerIds` field, the attacker can cause the current meeting — and potentially all meetings on the server — to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available.
Weakness: CWE-703
Which versions are affected by CVE-2025-61601?
It affects 1 product.
Products include Bigbluebutton Bigbluebutton.
How do I fix CVE-2025-61601?
No fix has been published for CVE-2025-61601 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-61601 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61601 exists.
Other vulnerabilities in bigbluebutton
Sources
Also known as GHSA-73j3-v3fq-fqx5.