Log in Start free

Vulnerability · Published Mar 27, 2025 · Assigned by VulDB

CVE-2025-2833zhangyd-c OneBlog HTTP Header redos

Medium 5.3

In plain English

A medium-severity regular-expression denial of service in OneBlog from zhangyd-c. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 45.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

VendorProductVersions
zhangyd-c OneBlog 2.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.7

Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References