# CVE-2025-6998: PYSEC-2026-1228 - Calibre Web and Autocaliweb have a ReDoS vulnerability

Source: https://junglewise.ai/threats/cve-2025-6998-calibre-web-and-autocaliweb-redos-in-strip-whitespaces  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2025-6998 · Severity: medium · CVSS 4 · Published 2026-07-07

Calibre Web and Autocaliweb are ebook management and sharing platforms that allow users to organize and access digital libraries. A denial-of-service vulnerability in the username validation function allows unauthenticated attackers to crash the service by submitting specially crafted usernames during login, causing the server to become unresponsive and unavailable to legitimate users.

Technologies: [calibreweb (PyPI)](https://junglewise.ai/threats/technologies/calibreweb). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-6998 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-6998 being exploited in the wild.

**How severe is CVE-2025-6998?** Medium severity, with a CVSS score of 4, published 7 July 2026.

**Which products and versions are affected?** Autocaliweb 0.7.0 before 0.7.1; Calibre Web 0.6.24 and earlier; calibreweb (PyPI) ECOSYSTEM:introduced=0,last_affected=0.6.24.

**Is there a fix for CVE-2025-6998?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-6998 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-6998?** Check whether you run Autocaliweb, Calibre Web or calibreweb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the strip_whitespaces() function in cps/string_helper.py due to catastrophic backtracking in a regular expression pattern. The vulnerability is triggered via a specially crafted username parameter during the login process, allowing unauthenticated remote attackers to cause denial of service. No authentication is required to exploit this vulnerability. The issue affects Calibre Web version 0.6.24 and Autocaliweb versions 0.7.0 through 0.7.0 (patched in 0.7.1). Patches are available; users should upgrade to patched versions.

## Affected products

- Calibre Web Calibre Web 0.6.24 and earlier
- Autocaliweb Autocaliweb 0.7.0 before 0.7.1

## Identifiers

- CVE-2025-6998
- GHSA-2g7m-ph9x-7q7m
- PYSEC-2026-1228

## Timeline

- 2025-07-24: disclosed: Vulnerability published in GHSA-2g7m-ph9x-7q7m and CVE-2025-6998

## References

- [https://fluidattacks.com/advisories/megadeth](https://fluidattacks.com/advisories/megadeth)

## Related threats

- [PYSEC-2026-1235 - Calibre Web and Autocaliweb have OS Command Injection vulnerability](https://junglewise.ai/threats/cve-2025-7404-calibre-web-and-autocaliweb-have-os-command-injection)
- [PYSEC-2026-1232 - Generation of Error Message Containing Sensitive Information in janeczku/calibre-web](https://junglewise.ai/threats/cve-2021-3986-generation-of-error-message-containing-sensitive-information-in)
- [PYSEC-2026-1236 - Cross-site Scripting (XSS) - DOM in janeczku/calibre-web](https://junglewise.ai/threats/cve-2021-3988-cross-site-scripting-xss-dom-in-janeczku-calibre-web)
- [PYSEC-2026-1229 - Improper Access Control in janeczku/calibre-web](https://junglewise.ai/threats/cve-2021-3987-improper-access-control-in-janeczku-calibre-web)
- [PYSEC-2026-1230 - Calibre-Web Cross Site Scripting (XSS)](https://junglewise.ai/threats/cve-2024-39123-calibre-web-cross-site-scripting-xss)