Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-gwc3-dztv-37dw
Summary
Calibre Web and Autocaliweb have a ReDoS vulnerability
ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
Aliases
0
alias CVE-2025-6998
1
alias GHSA-2g7m-ph9x-7q7m
Fixed_packages
Affected_packages
0
url pkg:pypi/calibreweb@0.6.12
purl pkg:pypi/calibreweb@0.6.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-6z85-9d5x-nyaq
2
vulnerability VCID-9jsz-tc58-2ud8
3
vulnerability VCID-am1q-9mhn-c7fr
4
vulnerability VCID-bkzx-fvcv-t3g8
5
vulnerability VCID-c5yg-2q1m-qkf6
6
vulnerability VCID-g6g1-rcqv-wkdj
7
vulnerability VCID-gb1g-yf4f-tygr
8
vulnerability VCID-gwc3-dztv-37dw
9
vulnerability VCID-hsbf-rfcu-qyaq
10
vulnerability VCID-jcpd-2fkh-mkc1
11
vulnerability VCID-kekh-f74c-m7bt
12
vulnerability VCID-kswt-bt4h-nbdf
13
vulnerability VCID-m8wg-f36t-pygt
14
vulnerability VCID-mayx-3wtu-nkbp
15
vulnerability VCID-s28v-vbvy-3bgb
16
vulnerability VCID-xmnj-teby-fygk
17
vulnerability VCID-y3wa-7wgk-3khp
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.12
1
url pkg:pypi/calibreweb@0.6.13
purl pkg:pypi/calibreweb@0.6.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-6z85-9d5x-nyaq
2
vulnerability VCID-9jsz-tc58-2ud8
3
vulnerability VCID-am1q-9mhn-c7fr
4
vulnerability VCID-bkzx-fvcv-t3g8
5
vulnerability VCID-c5yg-2q1m-qkf6
6
vulnerability VCID-g6g1-rcqv-wkdj
7
vulnerability VCID-gb1g-yf4f-tygr
8
vulnerability VCID-gwc3-dztv-37dw
9
vulnerability VCID-hsbf-rfcu-qyaq
10
vulnerability VCID-jcpd-2fkh-mkc1
11
vulnerability VCID-kekh-f74c-m7bt
12
vulnerability VCID-kswt-bt4h-nbdf
13
vulnerability VCID-m8wg-f36t-pygt
14
vulnerability VCID-mayx-3wtu-nkbp
15
vulnerability VCID-s28v-vbvy-3bgb
16
vulnerability VCID-xmnj-teby-fygk
17
vulnerability VCID-y3wa-7wgk-3khp
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.13
2
url pkg:pypi/calibreweb@0.6.14
purl pkg:pypi/calibreweb@0.6.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-6z85-9d5x-nyaq
2
vulnerability VCID-9jsz-tc58-2ud8
3
vulnerability VCID-am1q-9mhn-c7fr
4
vulnerability VCID-bkzx-fvcv-t3g8
5
vulnerability VCID-c5yg-2q1m-qkf6
6
vulnerability VCID-g6g1-rcqv-wkdj
7
vulnerability VCID-gb1g-yf4f-tygr
8
vulnerability VCID-gwc3-dztv-37dw
9
vulnerability VCID-hsbf-rfcu-qyaq
10
vulnerability VCID-jcpd-2fkh-mkc1
11
vulnerability VCID-kekh-f74c-m7bt
12
vulnerability VCID-kswt-bt4h-nbdf
13
vulnerability VCID-m8wg-f36t-pygt
14
vulnerability VCID-mayx-3wtu-nkbp
15
vulnerability VCID-s28v-vbvy-3bgb
16
vulnerability VCID-xmnj-teby-fygk
17
vulnerability VCID-y3wa-7wgk-3khp
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.14
3
url pkg:pypi/calibreweb@0.6.15
purl pkg:pypi/calibreweb@0.6.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-6z85-9d5x-nyaq
2
vulnerability VCID-9jsz-tc58-2ud8
3
vulnerability VCID-am1q-9mhn-c7fr
4
vulnerability VCID-bkzx-fvcv-t3g8
5
vulnerability VCID-g6g1-rcqv-wkdj
6
vulnerability VCID-gb1g-yf4f-tygr
7
vulnerability VCID-gwc3-dztv-37dw
8
vulnerability VCID-jcpd-2fkh-mkc1
9
vulnerability VCID-kekh-f74c-m7bt
10
vulnerability VCID-m8wg-f36t-pygt
11
vulnerability VCID-s28v-vbvy-3bgb
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.15
4
url pkg:pypi/calibreweb@0.6.16
purl pkg:pypi/calibreweb@0.6.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-bkzx-fvcv-t3g8
2
vulnerability VCID-g6g1-rcqv-wkdj
3
vulnerability VCID-gb1g-yf4f-tygr
4
vulnerability VCID-gwc3-dztv-37dw
5
vulnerability VCID-jcpd-2fkh-mkc1
6
vulnerability VCID-kekh-f74c-m7bt
7
vulnerability VCID-m8wg-f36t-pygt
8
vulnerability VCID-s28v-vbvy-3bgb
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.16
5
url pkg:pypi/calibreweb@0.6.17
purl pkg:pypi/calibreweb@0.6.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-bkzx-fvcv-t3g8
2
vulnerability VCID-gb1g-yf4f-tygr
3
vulnerability VCID-gwc3-dztv-37dw
4
vulnerability VCID-jcpd-2fkh-mkc1
5
vulnerability VCID-m8wg-f36t-pygt
6
vulnerability VCID-s28v-vbvy-3bgb
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.17
6
url pkg:pypi/calibreweb@0.6.18
purl pkg:pypi/calibreweb@0.6.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-bkzx-fvcv-t3g8
2
vulnerability VCID-gb1g-yf4f-tygr
3
vulnerability VCID-gwc3-dztv-37dw
4
vulnerability VCID-m8wg-f36t-pygt
5
vulnerability VCID-s28v-vbvy-3bgb
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.18
7
url pkg:pypi/calibreweb@0.6.19
purl pkg:pypi/calibreweb@0.6.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-bkzx-fvcv-t3g8
2
vulnerability VCID-gb1g-yf4f-tygr
3
vulnerability VCID-gwc3-dztv-37dw
4
vulnerability VCID-m8wg-f36t-pygt
5
vulnerability VCID-s28v-vbvy-3bgb
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.19
8
url pkg:pypi/calibreweb@0.6.20
purl pkg:pypi/calibreweb@0.6.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-gb1g-yf4f-tygr
2
vulnerability VCID-gwc3-dztv-37dw
3
vulnerability VCID-m8wg-f36t-pygt
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.20
9
url pkg:pypi/calibreweb@0.6.21
purl pkg:pypi/calibreweb@0.6.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-gb1g-yf4f-tygr
2
vulnerability VCID-gwc3-dztv-37dw
3
vulnerability VCID-m8wg-f36t-pygt
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.21
10
url pkg:pypi/calibreweb@0.6.22
purl pkg:pypi/calibreweb@0.6.22
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-gb1g-yf4f-tygr
2
vulnerability VCID-gwc3-dztv-37dw
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.22
11
url pkg:pypi/calibreweb@0.6.23
purl pkg:pypi/calibreweb@0.6.23
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-gb1g-yf4f-tygr
2
vulnerability VCID-gwc3-dztv-37dw
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.23
12
url pkg:pypi/calibreweb@0.6.24
purl pkg:pypi/calibreweb@0.6.24
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4xd2-y3tq-ckh8
1
vulnerability VCID-gb1g-yf4f-tygr
2
vulnerability VCID-gwc3-dztv-37dw
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/calibreweb@0.6.24
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-6998
reference_id
reference_type
scores
0
value 0.00202
scoring_system epss
scoring_elements 0.423
published_at 2026-06-05T12:55:00Z
1
value 0.00202
scoring_system epss
scoring_elements 0.42283
published_at 2026-06-07T12:55:00Z
2
value 0.00202
scoring_system epss
scoring_elements 0.42311
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-6998
1
reference_url https://fluidattacks.com/advisories/megadeth
reference_id
reference_type
scores
0
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-24T19:50:08Z/
url https://fluidattacks.com/advisories/megadeth
2
reference_url https://github.com/gelbphoenix/autocaliweb
reference_id
reference_type
scores
0
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-24T19:50:08Z/
url https://github.com/gelbphoenix/autocaliweb
3
reference_url https://github.com/janeczku/calibre-web
reference_id
reference_type
scores
0
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-24T19:50:08Z/
url https://github.com/janeczku/calibre-web
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-6998
reference_id CVE-2025-6998
reference_type
scores
0
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-6998
5
reference_url https://github.com/advisories/GHSA-2g7m-ph9x-7q7m
reference_id GHSA-2g7m-ph9x-7q7m
reference_type
scores
url https://github.com/advisories/GHSA-2g7m-ph9x-7q7m
Weaknesses
0
cwe_id 1333
name Inefficient Regular Expression Complexity
description The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score7.0 - 8.9
Exploitability0.5
Weighted_severity8.0
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-gwc3-dztv-37dw