Denial-of-Service Vulnerability in NamelessMC Website Software for Minecraft Servers
CVE-2025-29784

7.5HIGH

Key Information:

Vendor

NamelessMC

Status
NamelessMC
Vendor
CVE Published:
18 April 2025

What is CVE-2025-29784?

NamelessMC, a widely used software for managing Minecraft servers, has a vulnerability that affects version 2.1.4 and earlier. The issue arises from insufficient length validation for the 's' parameter in GET requests related to forum search functionality. This oversight enables attackers to input excessively long search queries, potentially leading to significant performance degradation and denial-of-service conditions. The vulnerability has been addressed in version 2.2.0, where proper validation controls have been implemented to mitigate this risk.

References

https://github.com/NamelessMC/Nameless/commit/f5341e56930...
https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0
https://github.com/NamelessMC/Nameless/security/advisorie...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.