CVE-2025-6998: Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoS

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-24 · updated 2026-06-17
Weakness: CWE-1333

Description

ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

Affected products

Autocaliweb: from 0.7.0 before 0.7.1 — fixed in 0.7.1
Calibre Web: 0.6.24

How to fix

Upgrade to a fixed version: Autocaliweb 0.7.1. Check the vendor advisory for mitigations.

References

https://fluidattacks.com/advisories/megadeth
https://github.com/gelbphoenix/autocaliweb
https://github.com/janeczku/calibre-web

Get alerted when CVE-2025-6998 or the next vulnerability affects your stack