CVE-2025-6998: ReDoS Vulnerability in Calibre Web and Autocaliweb
Summary
CVE-2025-6998: Calibre Web and Autocaliweb have a ReDoS vulnerability. Affects calibreweb versions < 0.6.24. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Calibre Web is an open-source web application that provides a user-friendly interface for managing and accessing eBooks stored in Calibre. It allows users to browse, read, and download eBooks from a web browser. Autocaliweb is a similar project that automates the management of Calibre libraries. Both applications are designed to enhance the accessibility of eBooks but have been found to be vulnerable to a ReDoS (Regular Expression Denial of Service) attack, which can severely impact their availability.
Vulnerability Detail
The vulnerability arises from the strip_whitespaces() function located in cps/string_helper.py. This function is susceptible to ReDoS attacks due to its handling of the username parameter during login. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted input that triggers catastrophic backtracking in the regular expression processing. This can lead to denial of service, making the application unresponsive. The issue affects Calibre Web versions up to 0.6.24 and Autocaliweb versions from 0.7.0 before 0.7.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize the username parameter before it reaches the strip_whitespaces() function. This can help mitigate the risk of ReDoS attacks until the package is updated.
Conclusion
The ReDoS vulnerability identified as CVE-2025-6998 in Calibre Web and Autocaliweb poses a significant risk to users by potentially allowing denial of service attacks. It is crucial to update to the latest versions of these applications to ensure security and maintain service availability.
See every vulnerability recorded for calibreweb →
FAQ
A ReDoS vulnerability occurs when an application is vulnerable to denial of service attacks due to inefficient regular expression processing, which can lead to excessive resource consumption.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The potential impacts include application downtime, unavailability of services for users, and possible exploitation by attackers to disrupt normal operations.
Yes, patches are available. Update Calibre Web to version 0.6.25 or later, or Autocaliweb to version 0.7.1 or later to mitigate this vulnerability.
If you cannot update immediately, implement input validation as a temporary workaround to reduce the risk of exploitation until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for calibreweb.
