CVE-2025-32944: PeerTube User Import Authenticated Persistent Denial of Service
The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. If the yauzl library encounters a filename that is considered illegal, it raises an exception that is uncaught by PeerTube, leading to a crash which repeats infinitely on startup.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32944?
CVE-2025-32944 is categorized as a denial-of-service vulnerability that can lead to the PeerTube server being rendered non-functional.
How do I fix CVE-2025-32944?
To fix CVE-2025-32944, upgrade your PeerTube installation to version 7.1.1 or later.
Who is affected by CVE-2025-32944?
Any instance of PeerTube with user import enabled is vulnerable to CVE-2025-32944.
What user actions trigger CVE-2025-32944?
CVE-2025-32944 can be triggered by any authenticated user uploading an archive for importing on the PeerTube server.
Can CVE-2025-32944 affect system performance?
Yes, CVE-2025-32944 can cause the PeerTube server to stop functioning, severely impacting system performance.