CVE-2025-41075: 
NixOS vulnerability analysis and mitigation

CVE-2025-41075 is a Denial of Service (DoS) vulnerability in LimeSurvey 6.13.0 caused by an infinite HTTP redirect loop at the /optin endpoint when accessed directly. The flaw allows unauthenticated remote attackers to exhaust server or client resources, leading to service degradation or browser instability. It was reported by the Spanish National Cybersecurity Institute (INCIBE) and published on November 20, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (INCIBE Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / 'Infinite Loop'): the /optin endpoint in LimeSurvey 6.13.0 enters an unbreakable HTTP redirect loop when accessed directly, without any mechanism to terminate the cycle. An unauthenticated attacker can trigger this behavior by sending a direct HTTP request to the affected endpoint, requiring no special privileges or user interaction. Repeated or concurrent requests to this endpoint can amplify resource exhaustion on both the server side (connection handling, memory) and the client side (browser instability). No public proof-of-concept code or detailed technical write-up beyond the INCIBE advisory has been identified (INCIBE Advisory).

Successful exploitation results in availability impact only — confidentiality and integrity are not affected. Attackers can degrade or disrupt the LimeSurvey service by exhausting server resources through the redirect loop, potentially rendering the survey platform unavailable to legitimate users. Client-side browser instability may also affect end users who inadvertently access the malformed endpoint. The scope is limited to the affected LimeSurvey instance and does not provide a pathway for lateral movement or data exfiltration (INCIBE Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-41075. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (INCIBE Advisory).

1. Reconnaissance: Identify internet-facing LimeSurvey 6.13.0 instances using search engines (e.g., Shodan, Censys) or by fingerprinting the application version via HTTP response headers or the LimeSurvey login page.
2. Target the vulnerable endpoint: Send a direct HTTP GET request to the /optin endpoint of the target LimeSurvey installation (e.g., GET https://target.example.com/index.php/optin).
3. Trigger the redirect loop: The server enters an infinite HTTP redirect cycle with no exit condition, consuming server-side connection and memory resources for each request.
4. Amplify the DoS: Send a high volume of concurrent requests to the /optin endpoint to accelerate resource exhaustion, degrading or crashing the LimeSurvey service for legitimate users (INCIBE Advisory).

• Network: High volume of HTTP requests targeting the /optin endpoint from one or more source IPs; repeated 3xx redirect responses in web server logs for the /optin path.
• Logs: Web server access logs showing a large number of requests to /index.php/optin or equivalent URL patterns with rapid succession; error logs indicating resource exhaustion or connection limit warnings.
• Process: Elevated CPU or memory usage by the web server process (e.g., Apache, Nginx, PHP-FPM) correlating with spikes in requests to the /optin endpoint.

The primary remediation is to upgrade LimeSurvey beyond version 6.13.0 to a patched release once available from the vendor. As a workaround, administrators can configure the web server (Apache/Nginx) to block or rate-limit direct external access to the /optin endpoint using access control rules or WAF policies. Additionally, implementing rate limiting at the network perimeter or load balancer level can reduce the impact of DoS attempts against this endpoint (INCIBE Advisory).

The vulnerability was disclosed by INCIBE as part of a multi-vulnerability advisory for LimeSurvey. No notable independent researcher commentary, vendor statements beyond the INCIBE advisory, or significant social media discussion has been identified for this CVE.