CVE-2025-61601

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-61601

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61601.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-61601

Aliases

GHSA-73j3-v3fq-fqx5

Published

2025-10-09T20:29:25.006Z

Modified

2026-07-15T01:49:02.483087510Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation

Details

BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's Choices response type. By submitting a malicious payload with a massive array in the answerIds field, the attacker can cause the current meeting — and potentially all meetings on the server — to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61601.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-703"
    ]
}

References

Affected packages

Git / github.com/bigbluebutton/bigbluebutton

Affected ranges

Type

GIT

Repo

https://github.com/bigbluebutton/bigbluebutton

Events

Introduced

Fixed

2004667668f7bbb29aa235943275ee76226bad4d

Database specific

{
    "cpe": "cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.13"
        }
    ]
}

Affected versions

2.*

2.2-beta-10

2.2-beta-11

2.2-beta-12

2.2-beta-14

2.2-beta-15

2.2-beta-16

2.2-beta-17

2.2-beta-18

2.2-beta-19

2.2-beta-2

2.2-beta-20

2.2-beta-21

2.2-beta-22

2.2-beta-23

2.2-beta-3

2.2-beta-4

2.2-beta-5

2.2-beta-6

2.2-beta-7

2.2-beta-8

2.2-beta-9

2.2-rc-1

2.2-rc-2

2.2-rc-3

3.*

3.0.0-rc.1

Other

dcs-2-a

v0.*

v0.8

v0.8b4

v0.8b4.0

v0.8rc2

v0.9.0-beta

v2.*

v2.3-alpha-1

v2.3-alpha-2

v2.3-alpha-3

v2.3-alpha-4

v2.3-alpha-5

v2.3-alpha-6

v2.3-alpha-7

v2.3-alpha-8

v2.3-beta-1

v2.3-beta-2

v2.3-beta-3

v2.3-beta-4

v2.3-beta-5

v2.3-rc-1

v2.3-rc-2

v2.3.0

v2.3.1

v2.4-alpha-1

v2.4-beta-1

v2.4-beta-2

v2.4-beta-3

v2.4-beta-4

v3.*

v3.0.0

v3.0.0-alpha.1

v3.0.0-alpha.2

v3.0.0-alpha.3

v3.0.0-alpha.4

v3.0.0-alpha.6

v3.0.0-alpha.7

v3.0.0-beta.1

v3.0.0-beta.2

v3.0.0-beta.3

v3.0.0-beta.4

v3.0.0-beta.5

v3.0.0-beta.6

v3.0.0-beta.7

v3.0.0-rc.1

v3.0.0-rc.2

v3.0.0-rc.3

v3.0.0-rc.4

v3.0.1

v3.0.10

v3.0.11

v3.0.12

v3.0.2

v3.0.3

v3.0.4

v3.0.5

v3.0.7

v3.0.8

v3.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61601.json"