CVE-2025-31482: FreshRSS vulnerable to DoS by malicious feed entry loading logout URL
Published Jun 4, 2025
·Updated
FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious feed entry, effectively causing that user to suffer denial of service. Version 1.26.2 contains a patch for the issue.
Affected Software
2 affected components
FreshRSS FreshRSS<1.26.2
FreshRSS FreshRSS<1.26.2
Event History
Jun 4, 2025
CVE Published
via MITRE·07:50 PM
Data Sourced
via MITRE·07:50 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-31482?
CVE-2025-31482 is classified as a denial of service vulnerability.
2
How do I fix CVE-2025-31482?
To fix CVE-2025-31482, upgrade your FreshRSS installation to version 1.26.2 or later.
3
What is affected by CVE-2025-31482?
CVE-2025-31482 affects FreshRSS versions prior to 1.26.2.
4
What happens if I am affected by CVE-2025-31482?
If affected by CVE-2025-31482, users may experience repeated logouts after fetching malicious feed entries.
5
Is there a patch for CVE-2025-31482?
Yes, FreshRSS version 1.26.2 includes a patch for CVE-2025-31482.