High severity · published Jul 10, 2025
CVE-2025-53634
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a slow loris attack, an attacker could cause Denial of Service (DoS). Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 1385bd8 and shipped in v0.1.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chall-manager · Ctfer-io
before 0.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53634
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53634
Patch
https://github.com/ctfer-io/chall-manager/commit/1385bd869142651146cd0b123085f91cec698636
Release Notes
https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4
Vendor Advisory
https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-ggmv-j932-q89q
More from Chall-manager
9.9
CVE-2026-32768
Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
9.8
CVE-2025-53633
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player
9.1
CVE-2025-53632
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player
