# CVE-2021-33563: Improper rate limiting in Koel

Source: https://junglewise.ai/threats/cve-2021-33563-improper-rate-limiting-in-koel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-06-01  
License: CC BY 4.0 with a link back

CVE-2021-33563 · Severity: info · Published 2021-06-01

Improper rate limiting in Koel

Technologies: [phanan/koel (Packagist)](https://junglewise.ai/threats/technologies/phanan-koel). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2021-33563 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-33563 being exploited in the wild.

**How severe is CVE-2021-33563?** Informational severity, published 1 June 2021.

**Which products and versions are affected?** phanan/koel (Packagist) ECOSYSTEM:introduced=0,fixed=5.1.4.

**Is there a fix for CVE-2021-33563?** Yes. phanan/koel (Packagist): upgrade to 5.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2021-33563?** Check whether you run phanan/koel (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phanan/koel (Packagist): upgrade to 5.1.4 or later

  ```sh
  composer require phanan/koel:^5.1.4
  ```


## Affected products

- phanan/koel (Packagist) ECOSYSTEM:introduced=0,fixed=5.1.4

## Identifiers

- CVE-2021-33563
- GHSA-r37h-j483-cjjm

## Related threats

- [Koel SSRF via IPv6 transition address bypass in isPublicHost](https://junglewise.ai/threats/cve-2026-54494-koel-ssrf-via-ipv6-transition-address-bypass-in-ispublichost)
- [Koel SSRF in Subsonic Internet Radio Stations](https://junglewise.ai/threats/cve-2026-54493-koel-ssrf-in-subsonic-internet-radio-stations)
- [Koel authenticated blind SSRF in Subsonic podcast creation](https://junglewise.ai/threats/cve-2026-54492-koel-authenticated-blind-ssrf-in-subsonic-podcast-creation)
- [Koel SSRF in podcast and radio fetch paths](https://junglewise.ai/threats/cve-2026-54491-koel-ssrf-in-podcast-and-radio-fetch-paths)
- [Koel SSRF in Subsonic podcast feed and stream helper](https://junglewise.ai/threats/koel-ssrf-in-subsonic-podcast-feed-and-stream-helper-4a257c9c)