CVE-2025-41074: 
NixOS vulnerability analysis and mitigation

CVE-2025-41074 is a Denial-of-Service (DoS) vulnerability in LimeSurvey 6.13.0 caused by an infinite HTTP redirect loop in the /optout endpoint when accessed directly. The flaw allows unauthenticated remote attackers to exhaust server or client resources, leading to service degradation or browser instability. It was reported by the Spanish National Cybersecurity Institute (INCIBE) and published on November 20, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (INCIBE Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / 'Infinite Loop'). When the /optout endpoint is accessed directly — without the expected context or parameters — LimeSurvey's redirect logic enters an unbreakable loop, continuously issuing HTTP redirect responses with no termination condition. No authentication, special privileges, or user interaction is required to trigger the loop; a simple direct HTTP request to the endpoint is sufficient. No public proof-of-concept code or detailed technical write-up beyond the INCIBE advisory has been identified at this time (INCIBE Advisory).

Successful exploitation results in a loss of availability for the affected LimeSurvey instance, as the server becomes occupied processing an unending chain of redirect responses, exhausting connection or processing resources. Client-side browsers following the redirect loop may also become unstable or unresponsive. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue affecting the LimeSurvey web application (INCIBE Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-41074. The EPSS score is approximately 0.042%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and no user interaction, making it trivially easy to attempt against any exposed LimeSurvey 6.13.0 instance (INCIBE Advisory).

1. Reconnaissance: Identify internet-facing LimeSurvey instances running version 6.13.0 using search engines like Shodan or Censys, or by fingerprinting the application via HTTP response headers or page content.
2. Trigger the redirect loop: Send a direct HTTP GET request to the /optout endpoint of the target LimeSurvey installation (e.g., GET /index.php/optout HTTP/1.1) without the expected session context or required parameters.
3. Resource exhaustion: Repeat the request in rapid succession (e.g., using a scripted loop with curl or a load-testing tool like ab or wrk) to amplify the impact, causing the server to process a high volume of redirect chains simultaneously.
4. Service degradation: The server's connection pool or processing capacity becomes saturated, resulting in degraded response times or complete unavailability of the LimeSurvey application for legitimate users (INCIBE Advisory).

• Network: High volume of HTTP requests targeting the /optout endpoint from a single or small set of source IPs; repeated HTTP 3xx redirect responses in rapid succession from the LimeSurvey server.
• Logs: Web server access logs (Apache/Nginx) showing an abnormal spike in requests to /index.php/optout or equivalent path; entries showing redirect chains (e.g., 301/302 status codes) with no terminal 200 response.
• Availability: Sudden increase in server CPU or memory utilization coinciding with requests to the /optout endpoint; legitimate users reporting inability to access the LimeSurvey application.

The primary remediation is to update LimeSurvey to a version beyond 6.13.0 that addresses this redirect loop. As a workaround, administrators can configure their web server (Apache/Nginx) or a WAF to block or rate-limit direct external access to the /optout endpoint until a patch is applied. Restricting access to the endpoint by IP allowlist or requiring authentication at the reverse proxy level can also mitigate the risk. Monitor the INCIBE advisory and LimeSurvey's official release notes for a confirmed patched version (INCIBE Advisory).

The vulnerability was disclosed by INCIBE as part of a notice covering multiple LimeSurvey vulnerabilities. No notable independent researcher commentary, social media discussion, or significant media coverage has been identified beyond standard vulnerability database aggregation (INCIBE Advisory).