BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed `reactionEmojiId` in the GraphQL mutation `chatSendMessageReaction`. Version 3.0.13 contains a patch. No known workarounds are available.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 09 Oct 2025 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed `reactionEmojiId` in the GraphQL mutation `chatSendMessageReaction`. Version 3.0.13 contains a patch. No known workarounds are available. | |
| Title | BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId | |
| Weaknesses | CWE-703 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-10-09T20:40:04.658Z
Reserved: 2025-09-26T16:25:25.151Z
Link: CVE-2025-61602
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-10-09T21:15:39.640
Modified: 2025-10-09T21:15:39.640
Link: CVE-2025-61602
Redhat
No data.
OpenCVE Enrichment
No data.