This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the ‘inbox’ endpoint when receiving crafted ActivityPub activities. The issue can lead to significant downtime and service disruption for users of the PeerTube platform.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-32947 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted ActivityPub activities to the PeerTube server’s ‘inbox’ endpoint. This will trigger an infinite loop, causing the server to become unresponsive and effectively denying service to legitimate users.
Affected Products
- PeerTube: A decentralized video hosting platform that can be affected by this vulnerability, leading to service interruptions.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of PeerTube where the issue has been addressed. Additionally, monitoring and rate-limiting incoming requests to the ‘inbox’ endpoint can help prevent exploitation.