CVE-2025-68148: 
NixOS vulnerability analysis and mitigation

CVE-2025-68148 is a denial-of-service vulnerability in FreshRSS, a free self-hostable RSS aggregator, that allows an authenticated attacker to globally deny access to feeds by manipulating proxy responses with false 429 Retry-After headers. The vulnerability affects FreshRSS versions 1.27.0 through 1.27.1 and was disclosed on December 24–27, 2025. It has been patched in version 1.28.0. The CVSS v3.1 base score is 7.5 (High) per NVD/Feedly estimates, though the GitHub Security Advisory rates it as Moderate (4.3) with privileges required (GitHub Advisory, Red Hat CVE).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): FreshRSS stored Retry-After rate-limit state in files keyed only by domain name, without accounting for the proxy used to fetch the feed. A malicious or compromised proxy could return a fabricated HTTP 429 Too Many Requests response with a large Retry-After value (e.g., 10,000 seconds), causing FreshRSS to block all users on the instance from accessing feeds from that domain for the specified duration. The fix (PR #8029) modifies the Retry-After file naming scheme to include the proxy address, so that a rogue proxy's injected rate-limit state is scoped to that proxy and does not affect other users or proxy configurations (GitHub Commit, GitHub Advisory).

Successful exploitation renders the FreshRSS instance unable to fetch feeds from targeted domains for all users, effectively making the aggregator unusable for the duration of the injected Retry-After period. An attacker targeting high-traffic feed domains (e.g., YouTube, Reddit, Medium) could disrupt the majority of users on a shared instance simultaneously. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory: an attacker subscribes to a feed using their own proxy (with SSL verification disabled), intercepts the response via a tool like Burp Suite, and modifies it to return HTTP 429 with a large Retry-After header. This can be repeated for many popular feed domains to maximize disruption. The EPSS score is approximately 0.036% (very low), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution or in-the-wild exploitation has been reported (GitHub Advisory, Red Hat CVE).

1. Prerequisite: Obtain a low-privileged account on the target FreshRSS instance (versions 1.27.0–1.27.1) and control or intercept a proxy server that the instance uses for feed fetching.
2. Subscribe to a target feed: Add a popular feed (e.g., https://bleepingcomputer.com/feed/) configured to use your controlled proxy, with SSL verification disabled and a long timeout (e.g., 900 seconds) to allow time for manual interception.
3. Intercept the feed fetch: Use Burp Suite or a similar proxy tool to intercept the outbound HTTP request from FreshRSS to the feed URL as it passes through your proxy.
4. Inject a false 429 response: Modify the proxy's response to return HTTP/2 429 Too Many Requests with a header Retry-After: 10000 (or any large value in seconds).
5. Trigger domain-wide block: FreshRSS processes the response and writes a Retry-After state file keyed to the feed's domain, blocking all users on the instance from fetching any feed from that domain for the specified duration.
6. Scale the attack: Repeat steps 2–5 for multiple high-traffic domains (e.g., youtube.com, reddit.com, medium.com) to render the instance unusable for the majority of users (GitHub Advisory).

• File System: Unexpected or numerous files in the FreshRSS DATA_PATH/Retry-After/ directory with domain names corresponding to popular feed providers (e.g., www.youtube.com.txt, www.reddit.com.txt); files containing unusually large future timestamps.
• Logs: FreshRSS application logs showing repeated warnings such as For that domain, will first retry after [far-future date] for multiple popular domains in a short time window; log entries showing HTTP 429 responses from feeds that are not normally rate-limited.
• Application Behavior: Users reporting inability to refresh feeds from multiple popular domains simultaneously; feed update failures across many categories affecting all users on the instance (GitHub Advisory, GitHub Commit).

Upgrade FreshRSS to version 1.28.0 or later, which includes the fix from PR #8029 that scopes Retry-After state files to the specific proxy used, preventing a rogue proxy from affecting other users. No configuration-based workaround is available for unpatched versions; however, administrators can mitigate risk by restricting which users are permitted to configure custom proxies for feed fetching, and by monitoring the DATA_PATH/Retry-After/ directory for suspicious entries. Manually deleting maliciously injected Retry-After files from that directory will restore feed access for affected domains (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researcher "Inverle" and the advisory was published by maintainer "Alkarex" on December 24, 2025. The fix was merged into the FreshRSS codebase on November 4, 2025 (ahead of the public disclosure), and shipped in the v1.28.0 release. No significant broader media coverage or notable community controversy has been identified beyond the standard vulnerability tracking channels (GitHub Advisory).