Calibre Web -- two vulnerabilities

2026-08-09 · CVE-2025-6998, CVE-2025-7404 · VuXML entry

The Calibre Web Team reports: ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1. Improper Neutralization of Special Elements …

Affected versions

• py310-calibreweb, py311-calibreweb, py312-calibreweb, py313-calibreweb, py313t-calibreweb, py314-calibreweb, py314t-calibreweb, py315-calibreweb >= 0.6.24 < 0.6.27

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.