{"id":"CVE-2025-30160","published":"2025-03-20T18:09:48Z","modified":"2025-03-20T19:19:50Z","title":"Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form","vendor":"redlib-org","product":"redlib","tier":"tail","description":{"text":"Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condition by submitting a specially crafted base2048-encoded DEFLATE decompression bomb to the restore_preferences form. This leads to excessive memory consumption and potential system instability, which can be exploited to disrupt Redlib instances. This vulnerability is fixed in 0.36.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00578,"percentile":0.476,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"},{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://github.com/redlib-org/redlib/security/advisories/GHSA-g8vq-v3mg-7mrg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/redlib-org/redlib/commit/15147cea8e42f6569a11603d661d71122f6a02dc","tags":["x_refsource_MISC"]},{"url":"https://github.com/redlib-org/redlib/commit/2e95e1fc6e2064ccfae87964b4860bda55eddb9a","tags":["x_refsource_MISC"]}],"priority":{"score":15.6,"factors":[{"name":"EPSS percentile","points":9.52},{"name":"CVSS severity","points":6.09}]},"vendorSlug":"redlib-org","affectedVersions":[{"vendor":"redlib-org","product":"redlib","versions":["< 0.36.0"]}],"affected":[{"ecosystem":"crates.io","package":"redlib","vulnerableRanges":["<0.36.0"],"patched":["0.36.0"],"from":["GHSA-g8vq-v3mg-7mrg"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-7180","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-crewjam-saml-cve-2020-27846","parents":[{"from":"CVE-2023-28119","to":"CVE-2025-30160","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-g8vq-v3mg-7mrg","via":"reference","url":"https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p"}]}]}}