CVE-2019-25585: 
Python vulnerability analysis and mitigation

CVE-2019-25585 is a denial of service (DoS) vulnerability in Deluge 1.3.15, a BitTorrent client, that allows local attackers to crash the application by supplying an excessively long string in the Webseeds field during torrent creation. The vulnerability was formally published on March 22, 2026, though it references a 2019 discovery. Only version 1.3.15 is confirmed affected. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (VulnCheck Advisory, Exploit-DB).

The root cause is classified under CWE-1260 (Improper Handling of Overlap Between Protected Memory Ranges), with an estimated secondary classification of CWE-125 (Out-of-bounds Read). Exploitation occurs locally when a user pastes a buffer of approximately 5,000 bytes or more into the Webseeds field during the torrent creation workflow, triggering an application crash. No authentication beyond local application access is required, and attack complexity is low. A proof-of-concept entry exists on Exploit-DB (EDB-46884), though its exploitability classification remains uncertain (Exploit-DB, VulnCheck Advisory).

Successful exploitation results in a crash of the Deluge application, causing a complete loss of availability for the affected instance. There is no impact on confidentiality or integrity — the vulnerability is limited to a local denial of service affecting only the Deluge process. Lateral movement and data exfiltration are not applicable given the local, availability-only nature of this vulnerability (VulnCheck Advisory).

A proof-of-concept entry is listed on Exploit-DB (EDB-46884), but its exploitability has not been confirmed as a functional exploit. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term (Exploit-DB, VulnCheck Advisory).

1. Local Access: Obtain local access to a system running Deluge 1.3.15 with standard user privileges sufficient to operate the application.
2. Open Torrent Creation Dialog: Launch Deluge and navigate to the torrent creation interface (typically via "Torrents" > "Create Torrent").
3. Locate Webseeds Field: In the torrent creation dialog, find the Webseeds input field.
4. Inject Oversized Input: Paste or type a string of approximately 5,000 bytes or more into the Webseeds field.
5. Trigger Crash: Submit or interact with the form to trigger the application crash, resulting in a denial of service for the Deluge process (Exploit-DB, VulnCheck Advisory).

• Process: Unexpected termination of the Deluge process (deluge, deluged, or deluge-gtk) without user-initiated shutdown.
• Logs: Application crash logs or core dump files generated in the Deluge working directory or system crash log (e.g., /var/log/syslog, ~/.config/deluge/deluge.log) around the time of the incident.
• File System: Presence of core dump files (e.g., core.*) in the Deluge installation or home directory following an unexpected crash.

No official patch information has been provided for Deluge 1.3.15. Users should upgrade to a version of Deluge later than 1.3.15 if available. As interim workarounds, administrators can implement input validation to restrict the length of strings accepted in the Webseeds field, or restrict local access to the Deluge application to trusted users only (VulnCheck Advisory).

The vulnerability received limited industry attention, with coverage primarily from automated vulnerability tracking platforms and aggregators such as ENISA EUVD, CIRCL, and VulnCheck. A brief technical write-up was published by Infinit Security (Infinit Security). No significant vendor statements, notable researcher commentary, or broad media coverage has been identified.