CVE-2025-46171: vBulletin DOS Vulnerability

CVE-2025-46171 Overview

CVE-2025-46171 is a denial-of-service vulnerability in vBulletin 3.8.7. The flaw resides in the misc.php?do=buddylist endpoint. An authenticated user with a sufficiently large buddy list can trigger excessive memory consumption during list processing. This resource exhaustion condition crashes the forum and denies service to legitimate users. The vulnerability is categorized under [CWE-400] Uncontrolled Resource Consumption. Exploitation requires authenticated access and user interaction, limiting the attack surface to registered forum members.

Critical Impact
An authenticated attacker can exhaust server memory and crash the vBulletin forum by loading an oversized buddy list through the misc.php?do=buddylist endpoint.

Affected Products

vBulletin 3.8.7
vBulletin 3.x branch installations exposing the buddy list feature
Forums running the legacy misc.php handler

Discovery Timeline

2025-07-23 - CVE-2025-46171 published to NVD
2026-07-05 - Last updated in NVD database

Technical Details for CVE-2025-46171

Vulnerability Analysis

The vulnerability affects the buddy list rendering logic reachable via misc.php?do=buddylist in vBulletin 3.8.7. When an authenticated user requests the endpoint, the application loads and processes each buddy list entry in memory. The handler does not enforce upper bounds on the number of entries processed per request. Users with large buddy lists cause the PHP process to allocate memory proportional to the list size. This allocation can exceed configured memory limits and crash the request worker. Repeated requests amplify the impact and can render the forum unavailable.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] in the buddy list processing routine. The endpoint iterates the full buddy relationship set without pagination, streaming, or memory ceilings. There is no server-side cap on buddy list size at either the storage or presentation layer.

Attack Vector

An authenticated attacker first accumulates a large number of buddy entries on their account. The attacker then issues requests to misc.php?do=buddylist, forcing the server to load the entire list. Each request consumes memory until the PHP worker exhausts available resources and terminates. Concurrent requests from one or more accounts extend the outage to other forum users. Refer to the GitHub PoC Repository for reproduction details.

Detection Methods for CVE-2025-46171

Indicators of Compromise

Repeated HTTP GET requests to misc.php?do=buddylist from a single authenticated session
PHP fatal errors referencing Allowed memory size exhausted in web server error logs
Sudden spikes in web worker memory usage correlated with buddy list requests
User accounts with anomalously large buddy relationship counts in the user and userlist tables

Detection Strategies

Monitor web server access logs for high-frequency requests to the misc.php?do=buddylist endpoint tied to individual user IDs.
Alert on PHP worker crashes and out-of-memory errors originating from the vBulletin process.
Query the vBulletin database for accounts holding buddy lists exceeding a defined threshold, such as several thousand entries.

Monitoring Recommendations

Track memory utilization on PHP-FPM or Apache worker processes and correlate with vBulletin URL patterns.
Deploy web application firewall rules to rate-limit requests to misc.php per authenticated session.
Log and review buddy list size changes to identify accumulation behavior preceding exploitation.

How to Mitigate CVE-2025-46171

Immediate Actions Required

Restrict access to the misc.php?do=buddylist endpoint through web server rules or authentication gating until a fix is applied.
Enforce a per-user buddy list size cap at the application or database level to prevent resource-abusive accounts.
Lower PHP memory_limit for the vBulletin virtual host to fail requests early rather than exhausting system memory.
Rate-limit requests to misc.php per session and per source IP using a reverse proxy or WAF.

Patch Information

vBulletin 3.8.7 is a legacy release and no vendor patch is referenced in the CVE record. Administrators should consult the GitHub PoC Repository for technical details and consider migrating to a supported vBulletin version. Where migration is not feasible, apply the workarounds below.

Workarounds

Disable the buddy list feature in the vBulletin AdminCP if it is not required by the community.
Add a server-side validation check that truncates buddy list rendering at a safe maximum count.
Block the do=buddylist query parameter at the web server or WAF for untrusted user groups.
Isolate the vBulletin PHP worker pool so buddy list exhaustion does not affect other applications on the host.

bash

# Nginx rate limit example for misc.php
limit_req_zone $binary_remote_addr zone=vb_misc:10m rate=5r/m;

location = /misc.php {
    limit_req zone=vb_misc burst=3 nodelay;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}