What’s Vulnerable › Vulnerabilities

CVE-2025-0588

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-11 · updated 2026-06-17
• Weakness: CWE-113

Description

In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly unusable. The user would be able to subsequently set and unset the referrer header to control the denial of service state with a valid CSRF token whilst new CSRF tokens could not be generated.

Affected products

• Octopus Deploy Octopus Server: from 2020.1.0 before 2024.3.13097; from 2024.4.401 before 2024.4.7091 — fixed in 2024.3.13097, 2024.4.7091

How to fix

Upgrade to a fixed version: Octopus Deploy Octopus Server 2024.3.13097, 2024.4.7091. Check the vendor advisory for mitigations.

References

• https://advisories.octopus.com/post/2024/sa2025-05/
• https://advisories.octopus.com/post/2024/sa2025-05/
• https://advisories.octopus.com/post/2025/sa2025-05/

Get alerted when CVE-2025-0588 or the next vulnerability affects your stack