CVE-2019-25585: medium-severity vulnerability in Dev Deluge
Deluge 1.3.15 Denial of Service via Webseeds Field
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Deluge 1.3.15 crashes when a user pastes an extremely long text (5000+ bytes) into the Webseeds field while creating a torrent. A local attacker can abuse this to crash the application and disrupt its availability.
A local denial of service vulnerability exists in Deluge 1.3.15's torrent creation functionality where the Webseeds input field lacks proper length validation. An attacker with local access can supply a buffer exceeding 5000 bytes to trigger an unhandled exception and application crash, resulting in unavailability of the service.
In the same product, most dangerous first.