Cyber Resilience

CVE-2025-53633

DoS in Ctfer-Io Chall-Manager ≤ 0.1.4

Published
10 July 2025
Modified
17 June 2026
Patch / advisory
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0046 38th percentile
Risk Priority 44 floored blend · peak EPSS

Summary

CVE-2025-53633 is a high-severity Amplification (CWE-405) vulnerability in Ctfer-Io Chall-Manager. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Denial of Service (T1498); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-53633 affects Chall-Manager, a platform-agnostic system designed to start challenges on demand for players. The vulnerability arises during the decoding of scenarios, which are zip archives, where the size of the decoded content is not checked. This flaw enables the decompression of zip bombs, leading to asymmetric resource consumption as described by CWE-405. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.

The vulnerability can be exploited by unauthenticated attackers with network access to the Chall-Manager instance, requiring no authorization. Successful exploitation allows attackers to trigger massive resource exhaustion through specially crafted zip bombs, potentially resulting in high-impact denial of service, as well as impacts to confidentiality, integrity, and availability per the CVSS vector. Although the Chall-Manager documentation highly recommends deploying the system deep within infrastructure to prevent direct user access due to its extensive capabilities, exposure could still enable remote exploitation.

Mitigation is available through a patch implemented in commit 14042aa, which has been shipped in version v0.1.4 of Chall-Manager. Security practitioners should update to this version promptly. Additional details are provided in the project's security advisory (GHSA-r7fm-3pqm-ww5w), the patch commit, and the release notes.

EU & UK References

Vulnerability Data

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not…

more

require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 14042aa and shipped in v0.1.4.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1498 Network Denial of Service Impact
Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users.
T1499.002 Service Exhaustion Flood Impact
Adversaries may target the different network services provided by systems to conduct a denial of service (DoS).
T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
T1498.002 Reflection Amplification Impact
Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target.
T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.001 OS Exhaustion Flood Impact
Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS).
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-53634Same product: Ctfer-Io Chall-Manager
CVE-2026-32768Same product: Ctfer-Io Chall-Manager
CVE-2025-53632Same product: Ctfer-Io Chall-Manager
CVE-2025-66564Shared CWE-405
CVE-2025-22166Shared CWE-405
CVE-2025-30204Shared CWE-405
CVE-2023-2992Shared CWE-405
CVE-2024-40705Shared CWE-405
CVE-2026-35626Shared CWE-405
CVE-2024-34702Shared CWE-405

Affected Assets

ctfer-io
chall-manager
≤ 0.1.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

SC-5 directly requires mechanisms to limit the effects of asymmetric resource exhaustion attacks such as amplification DoS.

SC-6 enforces resource quotas and priority allocation that reduce the impact of unauthenticated or low-effort resource requests.

Least-functionality disables unnecessary services or features that could be leveraged for amplification.

SC-7 boundary controls can filter or rate-limit traffic patterns that enable amplification without equivalent client work.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.IR-03 mostly match
prevents

Resilience mechanisms such as rate limiting and load balancing directly constrain asymmetric resource use.

PR.IR-04 mostly match
prevents

Capacity planning and monitoring maintain availability headroom against amplification attacks.

DE.CM-01 partial match
prevents

Network monitoring detects amplification traffic patterns but does not itself limit asymmetric consumption.

DE.CM-09 partial match
prevents

Runtime resource monitoring can surface excessive consumption yet does not enforce authorization or work proofs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

mitigates

Stress-testing and demand-reduction tactics (e.g., bandwidth throttling) blunt amplification vectors that would otherwise let an attacker multiply resource consumption through a single request.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (2 rules)
  • V-248553 OL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. prevents CWE-405
  • V-248552 OL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. prevents CWE-405
Oracle Linux 9 (2 rules)
  • V-271709 OL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. prevents CWE-405
  • V-271710 OL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. prevents CWE-405
RHEL 8 (2 rules)
  • V-230244 RHEL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. prevents CWE-405
  • V-244525 RHEL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. prevents CWE-405

References