CVE-2025-32947: PeerTube ActivityPub Crawl Infinite Loop DoS
Published Apr 15, 2025
·Updated
This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities.
Affected Software
2 affected components
PeerTube PeerTube
Framasoft Peertube<7.1.1
Remediation
Event History
Apr 15, 2025
CVE Published
via MITRE·02:45 PM
Data Sourced
via MITRE·02:45 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-32947?
CVE-2025-32947 is classified as a denial-of-service vulnerability that can severely disrupt PeerTube server functionality.
2
How do I fix CVE-2025-32947?
To mitigate CVE-2025-32947, you should update your PeerTube installation to version 7.1.1 or newer.
3
What impact does CVE-2025-32947 have on PeerTube servers?
CVE-2025-32947 allows attackers to exploit an infinite loop in the inbox endpoint, causing the PeerTube server to become unresponsive.
4
Who is affected by CVE-2025-32947?
Any PeerTube server running an affected version without the patch is vulnerable to CVE-2025-32947.
5
Is there a workaround for CVE-2025-32947?
There is no official workaround for CVE-2025-32947 other than applying the security update.