High severity · published Jul 24, 2025
CVE-2025-6998
Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoS
8.7
CVSS
1%
EPSS
No
On KEV
Description
ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
Autocaliweb · Autocaliweb
0.7.0 before 0.7.1 · source: vendor
CW
Calibre Web · Calibre Web
0.6.24 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6998
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6998
fluidattacks.com
https://fluidattacks.com/advisories/megadeth
github.com
https://github.com/gelbphoenix/autocaliweb
github.com
https://github.com/janeczku/calibre-web
More from Autocaliweb
9.8
CVE-2025-7404
Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C