Vulnerability · Published Mar 20, 2025 · Assigned by GitHub_M

CVE-2025-30160Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form

High 8.7

In plain English

A high-severity uncontrolled resource consumption in redlib from redlib-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.6%top 52.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condition by submitting a specially crafted base2048-encoded DEFLATE decompression bomb to the restore_preferences form. This leads to excessive memory consumption and potential system instability, which can be exploited to disrupt Redlib instances. This vulnerability is fixed in 0.36.0.

Affected products (as reported)

Vendor	Product	Versions
redlib-org	redlib	< 0.36.0

Weakness: CWE-400, CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/redlib-org/redlib/security/advisories/GHSA-g8vq-v3mg-7mrg x_refsource_CONFIRM
https://github.com/redlib-org/redlib/commit/15147cea8e42f6569a11603d661d71122f6a02dc x_refsource_MISC
https://github.com/redlib-org/redlib/commit/2e95e1fc6e2064ccfae87964b4860bda55eddb9a x_refsource_MISC