CVE-2025-29784

Summary

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum search functionality lacks length validation, allowing attackers to submit excessively long search queries. This oversight can lead to performance degradation and potential denial-of-service (DoS) attacks. This issue has been patched in version 2.2.0.

Affected Software

VendorProductVersion RangeStatus
NamelessMCNameless< 2.2.0affected

Weaknesses

  • CWE-130: CWE-130: Improper Handling of Length Parameter Inconsistency
  • CWE-20: CWE-20: Improper Input Validation
  • CWE-1284: CWE-1284: Improper Validation of Specified Quantity in Input

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

Additional References

References