What is the CVSS score of CVE-2025-46171?

CVE-2025-46171 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2025-46171?

Yes, a public proof-of-concept exploit is available for CVE-2025-46171. Prioritise patching immediately. EPSS: 0.3%.

vBulletin CVE-2025-46171

MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2025-07-23 cve@mitre.org

Denial Of Service PHP Vbulletin

5.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Requires authenticated session (PR:L); impact is solely availability loss from forum crash (A:H); no confidentiality or integrity impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:28 vuln.today

DescriptionCVE.org

vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum.

AnalysisAI

Uncontrolled resource consumption in vBulletin 3.8.7 allows an authenticated forum user to crash the forum by requesting the misc.php?do=buddylist endpoint when their buddy list is sufficiently large, exhausting server memory and causing a denial-of-service condition. The affected version (3.8.7) is a legacy release of the vBulletin PHP forum software, limiting the real-world attack surface to older, unmaintained deployments. No public exploit identified at time of analysis via CISA KEV, but a publicly available proof-of-concept exists on GitHub; EPSS sits at 0.25% (16th percentile), indicating low exploitation probability in the current threat landscape.

Technical ContextAI

vBulletin is a PHP-based commercial forum platform. Version 3.8.7 (CPE: cpe:2.3:a:vbulletin:vbulletin:3.8.7:*:*:*:*:*:*:*) is a legacy release from the 3.x branch, far superseded by the 5.x and 6.x series. The vulnerable code path resides in misc.php with the action parameter set to 'buddylist', which processes a forum user's contact/friend list. The root cause is CWE-400 (Uncontrolled Resource Consumption): when a user has accumulated an excessively large buddy list, the server-side PHP process iterates over or loads that list without enforcing a size or memory ceiling, consuming memory in proportion to list size until the host process is exhausted or killed. This is a classic resource exhaustion pattern in legacy PHP applications where pagination, lazy loading, or input bounds were not enforced at the data retrieval layer.

RemediationAI

No vendor-released patch is identified at the time of analysis for vBulletin 3.8.7; the 3.x branch has been end-of-life for years and is unlikely to receive security updates. The primary remediation is to upgrade to a supported vBulletin release (5.x or 6.x) or migrate to an actively maintained forum platform. As a compensating control, administrators can impose a hard limit on the maximum number of contacts a user may add (via admin panel settings if available in 3.8.7, or via direct database enforcement with a trigger or scheduled cleanup), which directly eliminates the unbounded growth condition that triggers the vulnerability. Additionally, applying PHP memory limits (memory_limit in php.ini) and per-request timeout settings (max_execution_time) will constrain the blast radius - the forum process will terminate with an error rather than consuming all available host memory, though the request will still fail. Rate-limiting or WAF rules on GET requests to misc.php?do=buddylist can reduce automated abuse. Each compensating control trades some legitimate functionality (large buddy lists, long PHP execution windows) for availability protection.