Executive brief
vBulletin, a popular forum software, is vulnerable to a denial-of-service attack within its buddy list feature. An authenticated user can create an excessively large list of friends, which causes the system to consume all available memory and database resources when trying to display the list. This can lead to significant website slowdowns or a complete crash of the forum, disrupting operations for all users.
Technical details
A denial-of-service vulnerability exists in vBulletin 3.8.7 due to uncontrolled resource consumption (CWE-400) in the `misc.php?do=buddylist` endpoint. The application executes a large SQL JOIN query involving the `userlist`, `user`, and `session` tables without pagination or result limits. An authenticated attacker can populate their buddy list with thousands of entries via the `profile.php` endpoint; subsequently, requesting the buddy list triggers an intensive database operation that exhausts memory and CPU. This can lead to database lag or a complete service crash. Mitigation involves implementing query pagination or limiting the number of buddy entries retrieved per request.
Affected products
- vBulletin vBulletin 3.8.7
Timeline
- 2025-04-17: other: Vulnerability discovered
- 2025-05-29: other: CVE-2025-46171 assigned
- 2025-06-27: disclosed: Public disclosure
- 2025-07-23: advisory: NVD published date