Junglewise Threat Intelligence

CVE-2025-53633: GO-2025-3810 - Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager

CVE-2025-53633 · Severity: medium · CVSS 4 · Published 2025-07-28

Technologies: github.com/ctfer-io/chall-manager (Go). Vendors: Go.

Executive brief

Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager

Affected products

Go github.com/ctfer-io/chall-manager

Related threats

GO-2025-3808 - Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive in github.com/ctfer-io/chall-manager
GO-2025-3809 - Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout in github.com/ctfer-io/chall-manager