Skip to content
OpenAdvisories

Package · Go

github.com/ctfer-io/chall-manager

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.7
    CVE-2025-53634

    Chall-Manager's HTTP Gateway have no header check timeout leading to potential slow loris attacks

    Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a slow loris attack, an attacker could cause Denial of Service (DoS). Exploitation does not require a…

    ctfer-io chall-manager github.com/ctfer-io/chall-manager Go
  • High 8.7
    CVE-2025-53633

    Chall-Manager's scenario decoding process does not check for zip bombs

    Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not re…

    ctfer-io chall-manager github.com/ctfer-io/chall-manager Go
  • High 8.8
    CVE-2025-53632 Public exploit

    Chall-Manager's scenario decoding process does not check for zip slips

    Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentica…

    ctfer-io chall-manager github.com/ctfer-io/chall-manager Go