CVE-2025-35436: CISA Thorium account verification email error handling
CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by providing a specially crafted email address or response. Fixed in commit 6a65a27.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-35436?
CVE-2025-35436 has been classified as a high severity vulnerability due to its potential to allow unauthenticated remote attackers to crash the application.
How do I fix CVE-2025-35436?
To fix CVE-2025-35436, update CISA Thorium to at least version 6a65a27.
What kind of attack does CVE-2025-35436 enable?
CVE-2025-35436 enables unauthenticated remote attackers to crash the application by providing specially crafted email addresses.
Which version of CISA Thorium is affected by CVE-2025-35436?
CISA Thorium versions prior to 6a65a27 are affected by CVE-2025-35436.
Is authentication required to exploit CVE-2025-35436?
No, CVE-2025-35436 can be exploited by unauthenticated users, allowing for remote attacks without authentication.