Jellysweep utiliza dados não controlados no endpoint da API de cache de imagem em github.com/jon4hz/jellysweep

The uncontrolled data handling within the image cache API allows an attacker to craft malicious requests that exhaust system resources. This can result in a denial-of-service, rendering the jellysweep application unavailable to legitimate users. The impact is primarily focused on service disruption, but depending on the criticality of jellysweep within an organization’s infrastructure, this could have cascading effects. While the vulnerability description doesn't explicitly detail specific attack vectors, it suggests the possibility of resource exhaustion through carefully crafted API calls. The blast radius is limited to the system hosting the jellysweep application.

Organizations that rely on jellysweep for image processing or caching are at risk. This includes developers and system administrators who manage jellysweep deployments. Environments where jellysweep is exposed to untrusted external networks are particularly vulnerable.

• go / server: Monitor application logs for unusual API requests related to image caching. Look for requests with excessively large payloads or unexpected data types.

journalctl -u jellysweep -f | grep "image cache API" 

• generic web: Use curl to test the image cache API endpoint with various payloads, including very large files or malformed data, to observe any abnormal behavior or resource consumption.

curl -F "image=@large_file.jpg" http://<jellysweep_server>/image_cache_api

1. 2025-11-17Disclosure

   disclosure

1. Reservado2025-10-28
2. Publicada2025-11-17
3. Modificada2026-03-03
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-64178 is to upgrade to version 0.13.0 of jellysweep, which addresses the uncontrolled data handling issue. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, consider implementing input validation and sanitization on the image cache API endpoint to restrict the size and type of data accepted. While a WAF might offer some protection, it's unlikely to be sufficient without application-level changes. Monitor system resources (CPU, memory) for unusual spikes that could indicate a DoS attack.