Denial of Service Vulnerability in BigBlueButton by Blindside Networks

CVE-2025-61601

What is CVE-2025-61601?

A Denial of Service vulnerability exists in BigBlueButton, the open-source virtual classroom software, that allows authenticated users to freeze or crash the server. This is achieved by exploiting the polling feature's Choices response type through malicious payloads loaded with large arrays in the answerIds field. As a result, the affected meeting and all concurrent meetings may become unresponsive. Users are advised to upgrade to version 3.0.13 or later, as earlier versions are susceptible to this attack. No known workarounds exist to mitigate this vulnerability.

References