CVE-2025-31118: NamelessMC DoS Vulnerability

CVE-2025-31118 Overview

CVE-2025-31118 affects NamelessMC, a website software package used by Minecraft server operators. The forum quick reply feature implemented in view_topic.php lacks any spam prevention or rate-limiting mechanism. Authenticated users can submit forum replies continuously without any time restriction between submissions. This uncontrolled posting behavior generates an unbounded surge of database writes and content that disrupts normal forum operations. The flaw is classified under [CWE-400] (Uncontrolled Resource Consumption) and impacts all NamelessMC versions up to and including 2.1.4. The maintainers released a fix in version 2.2.0.

Critical Impact
Authenticated attackers can flood NamelessMC forums with unlimited quick replies, exhausting database and server resources and rendering the forum unusable.

Affected Products

NamelessMC Nameless versions 2.1.4 and prior
Minecraft server community websites running vulnerable NamelessMC builds
Forum modules using the view_topic.php quick reply endpoint

Discovery Timeline

2025-04-18 - CVE-2025-31118 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31118

Vulnerability Analysis

The vulnerability resides in the NamelessMC Forum module, specifically in modules/Forum/pages/forum/view_topic.php. The quick reply handler accepts POST submissions from authenticated users and writes new posts to the database without enforcing any minimum delay between requests. No cooldown timer, CAPTCHA challenge, or per-user submission cap is applied. An authenticated attacker scripts repeated calls to the endpoint and inserts thousands of records into the topics and posts tables. The resulting write load consumes database connections, disk space, and application worker threads. Legitimate users experience degraded page loads or complete forum unavailability while administrators must manually prune the flood of posts.

Root Cause

The root cause is missing rate limiting on a state-changing endpoint. The quick reply flow trusted authenticated session state as sufficient authorization and skipped throttling checks that exist elsewhere in the application. Session cookies alone did not gate write frequency, and no IP-based fallback cache was consulted before persisting new posts.

Attack Vector

An attacker registers or logs into a NamelessMC forum, obtains a valid session, and submits automated POST requests to the quick reply handler in view_topic.php. Because no server-side throttle exists, each request produces a new row in the posts table and increments topic counters. Sustained requests exhaust database and web tier resources.

php

// Patch from view_topic.php introducing IP-based cache throttling
        DB::getInstance()->increment('topics', $tid, 'topic_views');
        Cookie::put('nl-topic-' . $tid, 'true', 3600);
    }
-} else {
-    if (!Session::exists('nl-topic-' . $tid)) {
+} elseif (!Session::exists('nl-topic-' . $tid)) {
+    // Fall back to IP check
+    $ip = HttpUtils::getRemoteAddress();
+    $cache->setCache("forum_views_$tid");
+
+    if (!$cache->isCached($ip)) {
        DB::getInstance()->increment('topics', $tid, 'topic_views');
        Session::put('nl-topic-' . $tid, 'true');
+        $cache->store($ip, true, 3600);
    }
}

Source: NamelessMC commit 51e9d93. The patch adds a cache-backed IP check that prevents repeated increments and, in the broader v2.2.0 release, adds throttling to the quick reply flow.

Detection Methods for CVE-2025-31118

Indicators of Compromise

Rapid growth of the nl2_posts table beyond baseline daily post volume
Sequential post timestamps from a single user account with sub-second intervals
Elevated HTTP POST rate to /forum/view_topic/?tid=<id> from one source IP
Database connection pool saturation and slow query logs referencing forum inserts

Detection Strategies

Monitor web server access logs for high-frequency POST requests to view_topic.php from single sessions
Alert on user accounts producing more than a defined threshold of posts per minute
Baseline forum activity metrics and flag standard deviation spikes in reply counts
Correlate authentication events with post creation rates to identify automated behavior

Monitoring Recommendations

Enable database query auditing on the posts and topics tables to capture insert bursts
Ship webserver and PHP-FPM logs to a centralized log platform for rate analysis
Track application performance metrics for spikes in write latency and connection usage

How to Mitigate CVE-2025-31118

Immediate Actions Required

Upgrade NamelessMC to version 2.2.0 or later where the quick reply throttling patch is applied
Restrict forum posting to trusted user groups until the upgrade is completed
Deploy a Web Application Firewall (WAF) rule to rate-limit POST requests to view_topic.php
Review recent post activity and remove spam entries created before mitigation

Patch Information

The issue is fixed in NamelessMC 2.2.0. Reference the GitHub Release v2.2.0, the GitHub Security Advisory GHSA-jhvp-mwj4-922m, and the remediation commit 51e9d93.

Workarounds

Enforce reverse-proxy rate limits on the forum reply endpoint at the network edge
Temporarily disable the quick reply feature and require full-page reply submissions with CAPTCHA
Apply per-account posting quotas through database triggers until the upgrade is deployed

bash

# Example nginx rate limit for the forum quick reply endpoint
limit_req_zone $binary_remote_addr zone=forum_reply:10m rate=6r/m;

server {
    location ~* /forum/view_topic {
        limit_req zone=forum_reply burst=3 nodelay;
        proxy_pass http://namelessmc_backend;
    }
}