GCVE - cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rathena:rathena:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Rathena (`05b9436b-a1d6-5ac2-935b-5f015a0b2280`)
Product	Rathena (`eb11ff80-fae2-5a92-b214-c8f5784ec456`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/rathena/rathena`	purl2cpe	2026-06-01 10:11:08.705164

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-62170`	vulnerable	2026-06-08 07:37:28.745732	rAthena map-server use-after-free vulnerability in RODEX HIGH (7.5) rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific attacking scenario to cause a denial of service by crashing the map-server. This issue has been patched in commit af2f3ba. There are no known workarounds aside from manually applying the patch. Published: 2025-10-13T17:45:21.365Z Updated: 2025-10-27T16:11:53.120Z Open on db.gcve.eu Reference links https://github.com/rathena/rathena/security/advisories/GHSA-9mj9-8vgv-r92j https://github.com/rathena/rathena/commit/af2f3ba33fc03dc6dd510f8cfe84cd9185af748d	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-58750`	vulnerable	2026-06-08 07:35:19.487271	rAthena missing bound check in chclif_parse_moveCharSlot HIGH (8.2) rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b. Published: 2025-09-09T22:14:40.265Z Updated: 2025-09-10T18:14:55.677Z Open on db.gcve.eu Reference links https://github.com/rathena/rathena/security/advisories/GHSA-pjh7-jgr8-4ff6 https://github.com/rathena/rathena/commit/0cc348b186bbcc3c604c17c39589a319f27d469b	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-58448`	vulnerable	2026-06-08 07:35:18.296416	rAthena has SQL Injection in PartyBooking component via `WorldName` parameter. CRITICAL (9.1) rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection in the PartyBooking component via `WorldName` parameter. Commit 0d89ae0 fixes the issue. Published: 2025-09-09T22:12:49.148Z Updated: 2025-09-10T19:29:20.032Z Open on db.gcve.eu Reference links https://github.com/rathena/rathena/security/advisories/GHSA-x99j-36m7-4vv7 https://github.com/rathena/rathena/commit/0d89ae071ff5e46e8dedcf45d060acec84b3abb5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-58447`	vulnerable	2026-06-08 07:35:18.295978	rAthena has heap-based buffer overflow in login server CRITICAL (9.8) rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue. Published: 2025-09-09T22:11:03.376Z Updated: 2025-09-10T19:30:07.516Z Open on db.gcve.eu Reference links https://github.com/rathena/rathena/security/advisories/GHSA-4p33-6xqr-cm6x https://github.com/rathena/rathena/commit/2f5248b9cd9a8c6b42422ddecfc4cc2cd0e69e4b	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.