FreshRSS CVE-2025-68148

Exploitation requires the attacker to influence HTTP responses for feeds that the FreshRSS instance polls - specifically returning an HTTP 429 status with a 'Retry-After' header - achievable by controlling a feed origin server, performing a man-in-the-middle on feed traffic, or getting attacker-chosen feeds subscribed on the instance. The vulnerable logic is the shared retry-after cache (FreshRSS_http_Util) that keyed the backoff file solely by domain and ignored the proxy parameter, so a single poisoned entry suppresses fetching across feeds/users. Affects FreshRSS 1.27.0 through versions before 1.28.0 only; LIMITING FACTORS: impact is availability of feed fetching only (no data exposure or code execution), it requires the attacker to control or intercept feed responses rather than only reach the FreshRSS web UI, and upgrading to 1.28.0 fully remediates it.

This is a genuine availability-only (DoS) flaw, not a high-CVSS inflation case, but its real-world priority is moderate rather than urgent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) reflects remote, low-complexity exploitation with no confidentiality or integrity impact - only availability. The GitHub advisory (GHSA-qw34-frg7-gf78) is tagged as exploit, so publicly available exploit code exists, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV, so there is 'no confirmed active exploitation (not in CISA KEV)'. No EPSS score was provided in the input, so exploitation probability cannot be weighed - STATE EXPLICITLY: EPSS is MISSING, limiting predictive-exploitation assessment. The source diff confirms the root cause (CWE-770): the Retry-After cache file was keyed only by target domain and ignored the proxy, so a 429 'Retry-After' response could poison the shared cache and suppress fetching across users/feeds. Net: a real, patchable integrity-of-service issue worth remediating promptly on internet-reachable or multi-user instances, but availability-only impact and a niche product footprint keep it below true emergency priority. One caveat: CVSS marks PR:N (unauthenticated), yet practical exploitation depends on the attacker influencing feed responses (controlling a feed server, MITM, or getting a malicious feed subscribed) - verify the trust boundary for your deployment.

An attacker who controls (or can MITM) a web server hosting feeds that a FreshRSS instance polls returns HTTP 429 responses with a large 'Retry-After' header for many feeds. Because the retry-after cache was keyed only by domain (not by proxy), FreshRSS caches the backoff and stops fetching those feeds for all users, rendering the aggregator unusable for the majority. Public exploit/advisory detail exists via the GitHub security advisory, lowering the barrier to reproduction.