{"id":"CVE-2025-6998","aliases":["GHSA-2g7m-ph9x-7q7m","PYSEC-2026-1228"],"title":"Calibre Web and Autocaliweb have a ReDoS vulnerability","summary":"Calibre Web and Autocaliweb have a ReDoS vulnerability","severity":"high","vendor":"calibreweb","product":"calibreweb","ecosystem":"pip","affected":["calibreweb <= 0.6.24"],"published":"2025-07-24","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2g7m-ph9x-7q7m","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6998"},{"url":"https://fluidattacks.com/advisories/megadeth"},{"url":"https://github.com/gelbphoenix/autocaliweb"},{"url":"https://github.com/janeczku/calibre-web"}],"tags":["osv","pip","exploit-available"],"epss":0.00841,"epssPercentile":0.5638,"ingestedAt":"2026-07-08T18:25:44.229Z","exploits":{"github":1,"githubRepos":["https://github.com/mind2hex/CVE-2025-6998-CalibreWeb-0.6.24-ReDoS"],"checkedAt":"2026-09-24T07:52:54.161Z"},"exploitAvailable":true,"slug":"CVE-2025-6998","body":"## Overview\n\nReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.\n\n## Affected packages\n\n- `calibreweb <= 0.6.24`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":4868,"id":"CVE-2025-6998","ts":1788887212563,"field":"exploit_available","old":"false","new":"true"},{"seq":3751,"id":"CVE-2025-6998","ts":1788886329161,"field":"exploit_available","old":"true","new":"false"},{"seq":2596,"id":"CVE-2025-6998","ts":1788883010252,"field":"exploit_available","old":"false","new":"true"},{"seq":1625,"id":"CVE-2025-6998","ts":1788882410529,"field":"exploit_available","old":"true","new":"false"},{"seq":736,"id":"CVE-2025-6998","ts":1788881847754,"field":"exploit_available","old":"false","new":"true"}]}