CVE-2025-6998

Name of the Vulnerable Software and Affected Versions Calibre Web version 0.6.24 (Nicolette) Autocaliweb version 0.7.0

Description A Regular Expression Denial of Service (ReDoS) issue exists in the strip whitespaces() function within cps/string helper.py. Unauthenticated remote attackers can exploit this to cause a denial of service by providing a specially crafted username parameter, triggering catastrophic backtracking during login.

Recommendations Calibre Web version 0.6.24 (Nicolette): At the moment, there is no information about a newer version that contains a fix for this vulnerability. Autocaliweb version 0.7.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.