CVE-2025-6998: 
Python vulnerability analysis and mitigation

CVE-2025-6998 is a Regular Expression Denial of Service (ReDoS) vulnerability in the strip_whitespaces() function located in cps/string_helper.py of Calibre Web and its fork Autocaliweb. Unauthenticated remote attackers can trigger catastrophic backtracking in the regex engine by submitting a specially crafted username during login, causing a denial of service condition. The vulnerability affects Calibre Web version 0.6.24 (Nicolette) and Autocaliweb versions 0.7.0 through before 0.7.1. It was published on July 24, 2025, and carries a CVSS v4.0 base score of 8.7 (High) (Github Advisory, Red Hat CVE).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity), where the strip_whitespaces() function in cps/string_helper.py employs a regular expression susceptible to exponential worst-case computational complexity (CAPEC-492: Regular Expression Exponential Blowup). An attacker exploits this by submitting a crafted username string to the login endpoint that causes the regex engine to enter catastrophic backtracking, consuming excessive CPU cycles. No authentication, special privileges, or user interaction is required — the attack is fully network-accessible with low complexity (Github Advisory, Red Hat CVE). A public proof-of-concept exploit is available on GitHub (PoC Exploit).

Successful exploitation causes the application to consume excessive CPU resources, rendering the Calibre Web or Autocaliweb service unresponsive and unavailable to legitimate users. The impact is limited to availability — there is no confidentiality or integrity impact, and no lateral movement or data exfiltration risk is associated with this vulnerability. Because no authentication is required, any network-reachable attacker can repeatedly trigger the condition to sustain a denial of service (Github Advisory, Red Hat CVE).

A public proof-of-concept exploit is available on GitHub at mind2hex/CVE-2025-6998-CalibreWeb-0.6.24-ReDoS, added to tracking feeds around July 28, 2025 (PoC Exploit). There is no confirmed evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.12–0.20%, placing it in roughly the 42nd percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing Calibre Web or Autocaliweb instances (e.g., via Shodan searching for the default port 8083) running version 0.6.24 or Autocaliweb 0.7.0.
2. Craft malicious payload: Construct a username string designed to trigger catastrophic backtracking in the vulnerable regex within strip_whitespaces() — typically a long string with repeated whitespace or special characters that exploit the regex's ambiguous matching paths.
3. Submit to login endpoint: Send an HTTP POST request to the application's login endpoint (e.g., /login) with the crafted username as the username parameter, requiring no authentication or session token.
4. Trigger denial of service: The regex engine enters exponential backtracking, consuming all available CPU cycles on the server process, causing the application to become unresponsive and denying service to legitimate users.
5. Sustain attack: Repeat requests to maintain the denial of service condition, as the vulnerability is triggered on each login attempt with the malicious payload (Github Advisory, PoC Exploit).

• Network: High volume of HTTP POST requests to the /login endpoint from one or more source IPs; requests containing unusually long or pattern-heavy username parameters with repeated whitespace or special characters.
• Logs: Application access logs showing repeated login attempts with malformed or oversized username values; server-side timeout or error entries in the Calibre Web application log coinciding with login requests.
• Process: Sustained high CPU utilization by the Calibre Web Python process (cps.py) without corresponding legitimate user activity; application becoming unresponsive or timing out during login processing.

For Autocaliweb, upgrade to version 0.7.1 or later, which patches the vulnerable regex in strip_whitespaces() (Github Advisory). For Calibre Web (janeczku), no patched version is listed in the GitHub Advisory as of the last update — users should monitor the upstream repository for a fix and consider applying the following interim mitigations: implement rate limiting on the login endpoint to reduce the attack surface, deploy a web application firewall (WAF) rule to reject login requests with excessively long or suspicious username patterns, and monitor CPU usage on the application server for anomalies. Since the vulnerability requires no authentication, prioritize patching or mitigating internet-exposed instances first (Red Hat CVE).

The vulnerability was discovered and reported by Fluid Attacks, who published an advisory at fluidattacks.com/advisories/megadeth (Github Advisory). No significant broader media coverage or notable community commentary beyond the standard vulnerability database entries has been identified at this time.