CVE-2025-32439: pleezer Deezer Connect Player DoS Vulnerability

CVE-2025-32439 Overview

CVE-2025-32439 affects pleezer, a headless Deezer Connect player. The vulnerability exists in versions prior to 0.16.0. Hook scripts triggered by playback events like track changes are spawned without proper process cleanup. Each event leaves a zombie process in the system's process table. Over time, the process table fills up and prevents new process creation. Rapid events, such as skipping through a playlist or manipulated Deezer Connect protocol traffic, accelerate exhaustion. The maintainers fixed the flaw in version 0.16.0. The weakness is classified under [CWE-460] Improper Cleanup on Thrown Exception.

Critical Impact

An authenticated attacker on the network can exhaust the host process table, denying service to pleezer and any other process on the system.

Affected Products

• pleezer headless Deezer Connect player (versions prior to 0.16.0)
• Hook script functionality tied to playback and track change events
• Any host system running vulnerable pleezer builds

Discovery Timeline

• 2025-04-15 - CVE-2025-32439 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32439

Vulnerability Analysis

pleezer executes user-defined hook scripts when events fire from the Deezer Connect protocol. These events include track changes and playback state transitions. The application spawns each hook as a child process but does not reap the child after termination. The result is a zombie entry retained in the operating system's process table for every event.

Under normal listening patterns, zombies accumulate steadily. Under rapid event conditions, accumulation is faster. When the per-user or system-wide process limit is reached, the kernel refuses to create additional processes. This affects pleezer itself and any other workload sharing the host.

The issue is limited to availability. Confidentiality and integrity are not impacted, since the flaw does not expose data or allow code execution.

Root Cause

The root cause is missing child process cleanup after hook script execution. In Unix-like systems, a parent process must call wait() or waitpid() on terminated children, or explicitly ignore SIGCHLD, to release process table entries. pleezer versions before 0.16.0 do neither for spawned hook scripts, leaving each terminated child in a zombie state.

Attack Vector

An attacker with low privileges on the network can trigger repeated playback events through the Deezer Connect protocol. Each triggered event forces pleezer to spawn a new hook script and leak another zombie entry. Sustained event generation drives the process table toward its limit. Once exhausted, the host cannot spawn new processes until existing zombies are reaped, which requires a pleezer restart on vulnerable builds.

See the GitHub Security Advisory GHSA-472w-7w45-g3w5 for the maintainer's technical writeup.

Detection Methods for CVE-2025-32439

Indicators of Compromise

• Growing count of processes in zombie state (Z in ps output) whose parent PID is the pleezer process
• fork() or process creation failures returning EAGAIN on hosts running pleezer
• Sudden inability to spawn new shells or system services on a host that hosts pleezer

Detection Strategies

• Monitor the child process count and zombie count per pleezer PID over time and alert on unbounded growth
• Track kernel and syslog entries reporting fork: retry: Resource temporarily unavailable correlated with pleezer activity
• Correlate spikes in Deezer Connect network traffic with concurrent zombie accumulation on the host

Monitoring Recommendations

• Add ps -eo stat,ppid,pid,comm | awk '$1 ~ /Z/' style checks to host monitoring for any process supervised by pleezer
• Watch /proc/sys/kernel/pid_max utilization and per-user process counts via ulimit -u
• Enable process telemetry on Linux endpoints to observe rapid, repeated child spawns tied to media playback events

How to Mitigate CVE-2025-32439

Immediate Actions Required

• Upgrade pleezer to version 0.16.0 or later on all affected hosts
• Restart the pleezer service after upgrading to clear existing zombie entries from the process table
• Restrict network exposure of pleezer to trusted clients only until patching is complete

Patch Information

The maintainer released a fix in pleezer version 0.16.0. The patched release ensures spawned hook script children are properly reaped after termination. Review the GitHub Security Advisory GHSA-472w-7w45-g3w5 for release details and upgrade instructions.

Workarounds

• Disable hook scripts in the pleezer configuration until the upgrade to 0.16.0 is applied
• Restrict Deezer Connect protocol access with a host or network firewall to limit event-driven triggers
• Schedule periodic pleezer restarts to flush zombie processes when immediate patching is not feasible

# Verify installed pleezer version and upgrade
pleezer --version
cargo install pleezer --version 0.16.0 --force

# Check for zombie children of pleezer
ps -eo pid,ppid,stat,comm | awk '$3 ~ /Z/ { print }'