BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a malicious payload with a massive array in the `answerIds` field, the attacker can cause the current meeting — and potentially all meetings on the server — to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Bigbluebutton |
|
No data.
No data.
References
History
Fri, 10 Oct 2025 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Bigbluebutton
Bigbluebutton bigbluebutton |
|
| Vendors & Products |
Bigbluebutton
Bigbluebutton bigbluebutton |
Thu, 09 Oct 2025 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a malicious payload with a massive array in the `answerIds` field, the attacker can cause the current meeting — and potentially all meetings on the server — to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available. | |
| Title | BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation | |
| Weaknesses | CWE-703 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2025-10-09T20:29:25.006Z
Updated: 2025-10-09T20:29:25.006Z
Reserved: 2025-09-26T16:25:25.151Z
Link: CVE-2025-61601
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-10-09T21:15:39.477
Modified: 2025-10-09T21:15:39.477
Link: CVE-2025-61601
Redhat
No data.