CVE-2019-25586: Deluge 1.3.15 Denial of Service via URL Field
Published Mar 22, 2026
·Updated
Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the URL field. Attackers can paste a buffer of 5000 characters into the 'From URL' field during torrent addition to trigger an application crash.
Affected Software
10 affected components
Deluge Deluge=1.3.15
Deluge-torrent Deluge=1.3.15
ubuntu/deluge*
ubuntu/deluge*
ubuntu/deluge*
ubuntu/deluge*
ubuntu/deluge*
ubuntu/deluge*
ubuntu/deluge*
ubuntu/deluge*
Event History
Mar 22, 2026
CVE Published
via MITRE·12:11 AM
Data Sourced
via MITRE·12:11 AM
DescriptionSeverityWeakness
Data Sourced
via OSV·01:16 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·01:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-25586?
CVE-2019-25586 has been classified as a denial of service vulnerability.
2
How do I fix CVE-2019-25586?
To mitigate CVE-2019-25586, consider upgrading to a newer version of Deluge or validating input length in the URL fields.
3
What version of Deluge is affected by CVE-2019-25586?
Deluge version 1.3.15 is the only version explicitly affected by CVE-2019-25586.
4
Who can exploit CVE-2019-25586?
Local attackers can exploit CVE-2019-25586 by inputting an excessively long URL string.
5
What happens if CVE-2019-25586 is exploited?
Exploitation of CVE-2019-25586 can cause the Deluge application to crash.