{"id":"CVE-2025-23197","aliases":["EUVD-2025-3141","GHSA-cr4q-jf47-3645"],"status":"published","title":"matrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub support","description":"matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00471,"percentile":0.4122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-754"],"published":"2025-01-27T17:21:40Z","modified":"2026-10-28T02:30:58Z","products":[{"vendor":"matrix-org","product":"matrix-hookshot"}],"references":[{"url":"https://github.com/matrix-org/matrix-hookshot/security/advisories/GHSA-cr4q-jf47-3645","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/matrix-org/matrix-hookshot/commit/e51d8210233ac759e7f7dfebc2c4f1bf6ce94802","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23197.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23197","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-23197","title":"matrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub support","description":"matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2.","status":"published","published":"2025-01-27T17:21:40.377Z","modified":"2025-02-12T20:41:35.629Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:32:33.410838Z"}],"euvd":[{"id":"EUVD-2025-3141","description":"matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2.","status":"published","published":"2025-01-27T17:21:40Z","modified":"2025-02-12T20:41:35Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:03:56.514594Z"}],"nvd":[{"id":"CVE-2025-23197","description":"matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2.","status":"published","published":"2025-01-27T18:15:41.037Z","modified":"2026-06-17T08:52:33.54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:10:49.841519Z"}],"osv":[{"id":"CVE-2025-23197","title":"matrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub support","description":"matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2.","status":"published","published":"2025-01-27T17:21:40.377Z","modified":"2026-10-28T02:30:58.910361392Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:44:47.009967Z"}]}}