CVE-2025-68148

HighCVSS 7.5/10Last modified Oct 13, 2026

Description

FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
FreshRSS	FreshRSS	>= 1.27.0, < 1.28.0

References

https://github.com/FreshRSS/FreshRSS/commit/7d4854a0a4f5665db599f18c34035786465639f3Patch
https://github.com/FreshRSS/FreshRSS/pull/8029Issue Tracking
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78Exploit, Patch, Vendor Advisory
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78Exploit, Patch, Vendor Advisory

Timeline

Published: Dec 27, 2025
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-68155.5The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th CVE-2025-681506.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.2 and 9.1.1-al CVE-2025-681517.5CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack CVE-2025-681524.9Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through sp CVE-2025-681536.5Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through sp CVE-2025-681548.1systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminforma CVE-2025-681557.5@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoi CVE-2025-681567.5Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flat CVE-2025-681573.7Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpU CVE-2025-681588.8Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token CVE-2025-68163.3A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /CVE-2025-681604.7Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes ca