Executive brief
Calibre Web and Autocaliweb are ebook management and sharing platforms that allow users to organize and access digital libraries. A denial-of-service vulnerability in the username validation function allows unauthenticated attackers to crash the service by submitting specially crafted usernames during login, causing the server to become unresponsive and unavailable to legitimate users.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the strip_whitespaces() function in cps/string_helper.py due to catastrophic backtracking in a regular expression pattern. The vulnerability is triggered via a specially crafted username parameter during the login process, allowing unauthenticated remote attackers to cause denial of service. No authentication is required to exploit this vulnerability. The issue affects Calibre Web version 0.6.24 and Autocaliweb versions 0.7.0 through 0.7.0 (patched in 0.7.1). Patches are available; users should upgrade to patched versions.
Affected products
- Calibre Web Calibre Web 0.6.24 and earlier
- Autocaliweb Autocaliweb 0.7.0 before 0.7.1
Timeline
- 2025-07-24: disclosed: Vulnerability published in GHSA-2g7m-ph9x-7q7m and CVE-2025-6998