CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes.
References
Configurations
History
23 Sep 2025, 15:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c#diff-bf9baa11b76cd169902a976bd17a5a6ee95a4098b2d3d150ba7d8f85b7e21dc9R281-R334 - Patch | |
| References | () https://github.com/cisagov/thorium/releases/tag/1.1.1 - Release Notes | |
| References | () https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json - Vendor Advisory | |
| References | () https://www.cve.org/CVERecord?id=CVE-2025-35432 - Third Party Advisory | |
| First Time |
Cisa
Cisa thorium |
|
| CPE | cpe:2.3:a:cisa:thorium:1.1.0:*:*:*:*:*:*:* |
17 Sep 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-17 17:15
Updated : 2025-09-23 15:44
NVD link : CVE-2025-35432
Mitre link : CVE-2025-35432
CVE.ORG link : CVE-2025-35432
JSON object : View
Products Affected
cisa
- thorium
CWE
CWE-400
Uncontrolled Resource Consumption