Denial of Service Vulnerability in Octopus Server by Octopus Deploy

CVE-2025-0588

What is CVE-2025-0588?

In certain versions of Octopus Server, a vulnerability allows users with adequate permissions to manipulate custom headers in server responses. By crafting a specific referrer header, an attacker could cause all subsequent responses to result in server errors (500), leading to significant disruption and a denial of service condition. This manipulation can be repeatedly enabled or disabled to maintain service unavailability, creating a persistent denial of service state. Additionally, an attacker requires a valid CSRF token to execute this exploit while being unable to generate new tokens.

References