CVE-2025-32944: PeerTube User Import Authenticated Persistent Denial of Service
First published: Tue Apr 15 2025(Updated: )
The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. If the yauzl library encounters a filename that is considered illegal, it raises an exception that is uncaught by PeerTube, leading to a crash which repeats infinitely on startup.
Credit: reefs@jfrog.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PeerTube |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-32944?
CVE-2025-32944 is categorized as a denial-of-service vulnerability that can lead to the PeerTube server being rendered non-functional.
How do I fix CVE-2025-32944?
To fix CVE-2025-32944, upgrade your PeerTube installation to version 7.1.1 or later.
Who is affected by CVE-2025-32944?
Any instance of PeerTube with user import enabled is vulnerable to CVE-2025-32944.
What user actions trigger CVE-2025-32944?
CVE-2025-32944 can be triggered by any authenticated user uploading an archive for importing on the PeerTube server.
Can CVE-2025-32944 affect system performance?
Yes, CVE-2025-32944 can cause the PeerTube server to stop functioning, severely impacting system performance.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/peertube
- canonical/peertube