CVE-2025-35436
📋 TL;DR
CVE-2025-35436 is an uncaught exception vulnerability in CISA Thorium's account verification email handling. An unauthenticated remote attacker can cause a denial of service by triggering a crash via specially crafted email inputs. This affects all Thorium deployments with account verification enabled.
💻 Affected Systems
- CISA Thorium
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage through repeated crashes, potentially disrupting authentication workflows and user onboarding.
Likely Case
Intermittent service disruptions affecting account verification functionality, requiring manual restart of affected services.
If Mitigated
Minimal impact with proper error handling and monitoring in place to detect and restart crashed services.
🎯 Exploit Status
Attack requires sending specially crafted email addresses or responses to trigger the unwrap() panic
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 6a65a27 or later
Vendor Advisory: https://github.com/mjcarson/thorium/commit/6a65a2711fb2387e8c3eacebc774053741bf5aeb
Restart Required: Yes
Instructions:
1. Pull latest Thorium code from repository. 2. Apply commit 6a65a27. 3. Rebuild and redeploy Thorium. 4. Restart Thorium services.
🔧 Temporary Workarounds
Disable account verification emails
allTemporarily disable email-based account verification to prevent exploitation
Configure Thorium to disable email verification in settings
Implement input validation
allAdd email address validation before processing verification requests
Add email format validation in account verification handler
🧯 If You Can't Patch
- Implement rate limiting on account verification endpoints
- Deploy monitoring to detect and automatically restart crashed Thorium processes
🔍 How to Verify
Check if Vulnerable:
Check Thorium version/git commit hash against vulnerable range (pre-6a65a27)Check Version:
git log --oneline -1Verify Fix Applied:
Verify commit 6a65a27 is applied and test account verification with malformed email inputs📡 Detection & Monitoring
Log Indicators:
- Panic logs containing 'unwrap()' errors
- Service crash/restart events in Thorium logs
- Unusual volume of account verification requests
Network Indicators:
- Multiple failed account verification attempts from single source
- Unusual patterns in email parameter values
SIEM Query:
source="thorium.logs" AND ("panic" OR "unwrap" OR "account verification failed")