Quick answers
- Is CVE-2025-46171 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-46171 being exploited in the wild.
- How severe is CVE-2025-46171?
- Medium severity, with a CVSS score of 5.4, published 23 July 2025.
- Which products and versions are affected?
- vBulletin vBulletin 3.8.7.
- Is there a fix for CVE-2025-46171?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-46171 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-46171?
- Check whether you run Vbulletin. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A denial-of-service vulnerability exists in vBulletin 3.8.7 due to uncontrolled resource consumption (CWE-400) in the `misc.php?do=buddylist` endpoint. The application executes a large SQL JOIN query involving the `userlist`, `user`, and `session` tables without pagination or result limits. An authenticated attacker can populate their buddy list with thousands of entries via the `profile.php` endpoint; subsequently, requesting the buddy list triggers an intensive database operation that exhausts memory and CPU. This can lead to database lag or a complete service crash. Mitigation involves implementing query pagination or limiting the number of buddy entries retrieved per request.
Affected products
- vBulletin vBulletin 3.8.7
Timeline
- 2025-04-17: other: Vulnerability discovered
- 2025-05-29: other: CVE-2025-46171 assigned
- 2025-06-27: disclosed: Public disclosure
- 2025-07-23: advisory: NVD published date