CVE-2025-29784
NamelessMC Has Lack of Length Validation for s Parameter in GET Requests
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
NamelessMC Has Lack of Length Validation for s Parameter in GET Requests
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum search functionality lacks length validation, allowing attackers to submit excessively long search queries. This oversight can lead to performance degradation and potential denial-of-service (DoS) attacks. This issue has been patched in version 2.2.0.
Reserved 2025-03-11 | Published 2025-04-18 | Updated 2025-04-18 | Assigner GitHub_MCWE-130: Improper Handling of Length Parameter Inconsistency
CWE-20: Improper Input Validation
CWE-1284: Improper Validation of Specified Quantity in Input
github.com/...meless/security/advisories/GHSA-4hrq-rf96-c2jm
github.com/...ommit/f5341e56930a98978171e0a871d60f19ab30ebdd
github.com/NamelessMC/Nameless/releases/tag/v2.2.0
Support options
