CVE-2025-32944: Framasoft PeerTube DOS Vulnerability

CVE-2025-32944 Overview

CVE-2025-32944 is a persistent denial-of-service vulnerability affecting Framasoft PeerTube, the federated video hosting platform. Any authenticated user can crash the server by uploading a specially crafted user import archive. The yauzl ZIP-parsing library throws an uncaught exception when it encounters a filename it considers illegal, terminating the PeerTube process. Because the malicious archive persists on disk, the server re-reads it during every startup attempt, causing the crash to repeat indefinitely. The flaw is tracked under CWE-248: Uncaught Exception.

Critical Impact
An authenticated user on a PeerTube instance with default settings can permanently disable the service until administrators manually remove the malicious archive from the filesystem.

Affected Products

Framasoft PeerTube versions prior to 7.1.1
PeerTube instances with user import enabled (default configuration)
Self-hosted federated PeerTube deployments

Discovery Timeline

2025-04-15 - CVE-2025-32944 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32944

Vulnerability Analysis

PeerTube supports a user data import feature that accepts ZIP archives containing account content. The server processes uploaded archives using the yauzl Node.js library to enumerate and extract entries. When yauzl encounters a filename it flags as illegal, it emits an exception that PeerTube does not catch, causing the Node.js process to terminate.

The persistence characteristic distinguishes this issue from a transient crash. The archive remains queued on disk after the initial failure. Each subsequent PeerTube restart attempts to resume processing of the same import job, re-triggering the uncaught exception. Recovery requires operator intervention on the underlying filesystem.

This vulnerability requires only low-privileged authenticated access. Any registered user on an instance with default import settings can trigger the condition.

Root Cause

The root cause is missing exception handling around the yauzl archive parsing routines. The library's contract raises exceptions for malformed or policy-violating entries. PeerTube's import handler does not wrap these calls in a try/catch or attach an error listener, so the exception propagates to the Node.js runtime and terminates the event loop.

Attack Vector

The attack is delivered over the network by an authenticated user with standard registration privileges. The attacker crafts a ZIP archive containing at least one entry with a filename yauzl rejects as illegal. The attacker uploads the archive through the user import endpoint. Processing fails, the PeerTube process exits, and the stored archive re-triggers the crash on every restart.

Refer to the JFrog Vulnerability Analysis - PeerTube DoS writeup for technical details on the malformed filename patterns that trigger the exception.

Detection Methods for CVE-2025-32944

Indicators of Compromise

Repeated PeerTube process exits shortly after startup with yauzl-related stack traces in application logs
Presence of user-uploaded ZIP archives in the PeerTube import staging directory that fail to process
Systemd or process supervisor logs showing continuous restart loops of the PeerTube service
Unexpected authenticated POST requests to the user import endpoint from low-privilege accounts

Detection Strategies

Monitor PeerTube application logs for uncaught exception traces referencing yauzl or ZIP filename validation errors
Alert on Node.js process crashes correlated with import job execution
Review the user import queue for archives from newly registered or low-reputation accounts

Monitoring Recommendations

Instrument the PeerTube service with process supervision that captures exit codes and stderr output
Track filesystem changes to the import staging directory and correlate with authenticated user actions
Establish log forwarding from PeerTube nodes to a central analytics platform for retention and search across restart events

How to Mitigate CVE-2025-32944

Immediate Actions Required

Upgrade PeerTube to version 7.1.1 or later, which contains the exception handling fix
If unable to patch immediately, disable the user import feature in the PeerTube configuration
Audit the import staging directory and remove any pending archives from untrusted users
Review user registration policies and consider disabling open registration on public instances until patched

Patch Information

Framasoft addressed the issue in PeerTube Release v7.1.1. Administrators should update to this release or a later maintained version. After upgrading, restart the PeerTube service and confirm that import jobs process without terminating the runtime.

Workarounds

Set the user import configuration option to disabled until the upgrade is applied
Restrict the user import endpoint at the reverse proxy layer to trusted administrator accounts only
Manually clear the import queue directory before restarting PeerTube if the service is stuck in a crash loop
Require email verification and rate limits on new account creation to raise the cost of exploitation

bash

# Disable user import in production.yaml (workaround until patched)
import:
  users:
    enabled: false

# Verify the running PeerTube version
sudo -u peertube NODE_ENV=production node dist/server --version