coollabsio coolify up to 4.0.0-beta.434 http headers for scripting syntax

Summaryinfo

A vulnerability was found in coollabsio coolify up to 4.0.0-beta.434. It has been rated as critical. Impacted is an unknown function. This manipulation causes improper neutralization of http headers for scripting syntax. The identification of this vulnerability is CVE-2025-64425. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in coollabsio coolify up to 4.0.0-beta.434 and classified as critical. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a improper neutralization of http headers for scripting syntax vulnerability. The CWE definition for the vulnerability is CWE-644. The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request to a malicious value. The victim will receive a password reset email, with a link to the malicious host. If the victim clicks this link, their reset token is sent to the attacker's server, allowing the attacker to use it to change the victim's password and takeover their account. As of time of publication, it is unclear if a patch is available.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-64425 since 11/03/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/13/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-206233) and CERT Bund (WID-SEC-2026-0031). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• coollabsio

Name

• coolify

Version

• 4.0.0-beta.434

Website

• Product: https://github.com/coollabsio/coolify/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion