This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+1 more
Affected surfaces
ReleasePort's take
Moderate signalThis release patches a rate‑limit bypass in the email verification endpoint and mitigates log‑flood DoS by suppressing full stack traces for WebExchangeBindException.
Why it matters: The email verification code fix blocks exploit of severity 80, while the logging change prevents DoS attacks (severity 70) that could overwhelm monitoring systems. Address both to protect authentication flow and operational stability.
Summary
AI summaryUpdates 功能优化, 开发者相关, and 问题修复 across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Fixes send email verification code endpoint rate‑limit bypass vulnerability. Fixes send email verification code endpoint rate‑limit bypass vulnerability. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Security | High |
Suppresses full stack trace output for WebExchangeBindException to prevent log‑flood DoS attacks. Suppresses full stack trace output for WebExchangeBindException to prevent log‑flood DoS attacks. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
Adds default user agreement and privacy policy pages. Adds default user agreement and privacy policy pages. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
Adds ability to require terms acceptance on registration page. Adds ability to require terms acceptance on registration page. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
Adds rate limiting for TOTP two‑factor authentication. Adds rate limiting for TOTP two‑factor authentication. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
Adds select option support for icons and descriptions in FormKit. Adds select option support for icons and descriptions in FormKit. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
Adds preview images to theme management list. Adds preview images to theme management list. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Fixes “Remember me” token rotation causing CookieTheftException and deletion of all tokens in concurrent login scenarios. Fixes “Remember me” token rotation causing CookieTheftException and deletion of all tokens in concurrent login scenarios. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Fixes preview article rendering issue with custom templates. Fixes preview article rendering issue with custom templates. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Fixes editor undo issue causing duplicate image uploads. Fixes editor undo issue causing duplicate image uploads. Source: llm_adapter@2026-06-12 Confidence: high |
— |
Full changelog
新特性
- 支持在表格中拖动调整行高 by @LIlGG in https://github.com/halo-dev/halo/pull/10004
- 添加默认的用户协议和隐私政策页面 by @ruibaby in https://github.com/halo-dev/halo/pull/9988
- 支持为注册页面添加同意条款 by @ruibaby in https://github.com/halo-dev/halo/pull/9978
- 附件选择界面支持全选当前页 by @ruibaby in https://github.com/halo-dev/halo/pull/9960
功能优化
- 两步验证支持自动提交 by @ruibaby in https://github.com/halo-dev/halo/pull/10016
- 改进备份恢复失败的错误信息，通过提供更具体的提示来识别格式错误或不兼容的备份文件 by @ruibaby in https://github.com/halo-dev/halo/pull/9987
- 将编辑器拖拽时的预览组件调整到鼠标右下角 by @LIlGG in https://github.com/halo-dev/halo/pull/9985
- 附件存储策略和分组选择表单项支持管理功能，方便在不打断流程的情况下新建存储策略和分组 by @ruibaby in https://github.com/halo-dev/halo/pull/9966
- 在主题/插件的上传和远程下载界面添加安全提示 by @ruibaby in https://github.com/halo-dev/halo/pull/9956
- 优化默认搜索引擎的关键词兼容性 by @ruibaby in https://github.com/halo-dev/halo/pull/9986
- Console 端插件列表的关键词搜索改为前端搜索，以获得更及时的搜索反馈 by @ruibaby in https://github.com/halo-dev/halo/pull/10058
- 主题管理列表支持显示预览图 by @ruibaby in https://github.com/halo-dev/halo/pull/10049
- 为控制台的按钮组件增加点击反馈 by @ruibaby in https://github.com/halo-dev/halo/pull/10037
- 为个人中心 - 消息通知列表新增批量选择功能 by @Eccent001 in https://github.com/halo-dev/halo/pull/10006
- 添加对 TOTP 双因素认证的速率限制 by @eddieran in https://github.com/halo-dev/halo/pull/9973
问题修复
- 修复预览文章不支持通过自定义模板渲染的问题 by @ruibaby in https://github.com/halo-dev/halo/pull/10032
- 为记住登录状态添加 token 旋转冷却期（默认 5 分钟），减少因多设备并发请求导致的 CookieTheft 误判，并增加 info 级别诊断日志。 by @JohnNiang in https://github.com/halo-dev/halo/pull/10014
- 抑制表单绑定异常（WebExchangeBindException）的完整堆栈日志输出，防止日志泛洪 DoS 攻击。 by @JohnNiang in https://github.com/halo-dev/halo/pull/10011
- 解决编辑器中无法一次撤销多张图片且会导致图片重复上传的问题。 by @LIlGG in https://github.com/halo-dev/halo/pull/9983
- 解决在编辑器中拉选多行时导致的滚动过快的问题 by @LIlGG in https://github.com/halo-dev/halo/pull/9974
- 修复发送邮箱验证码接口的限流绕过漏洞 by @JohnNiang in https://github.com/halo-dev/halo/pull/9949
- 修复在文章内容未修改时切换「自动生成摘要」设置后摘要未重新生成的问题 by @ruibaby in https://github.com/halo-dev/halo/pull/10042
- 修复“记住我”功能在并发请求场景下可能抛出 CookieTheftException 导致所有 Token 被删除的问题 by @JohnNiang in https://github.com/halo-dev/halo/pull/10005
开发者相关
- 支持通过主题扩展 Console 和 UC 的页面 by @ruibaby in https://github.com/halo-dev/halo/pull/10053
- 为主题新增
postFinder.cursorByCategory()，支持在分类中导航 by @ruibaby in https://github.com/halo-dev/halo/pull/9977 - 主题支持通过
#halo.matchVersion('<version>')判断 Halo 版本范围 by @ruibaby in https://github.com/halo-dev/halo/pull/9951 - FormKit Secret 支持设置描述预设文本 by @ruibaby in https://github.com/halo-dev/halo/pull/10027
- 插件默认从 resources/ui 读取前端资源，console 目录将继续兼容 by @ruibaby in https://github.com/halo-dev/halo/pull/10010
- 将 HttpSecurityUtils 移入 api 模块，供插件使用 by @JohnNiang in https://github.com/halo-dev/halo/pull/10061
- 支持使用 ui-plugin-bundler-kit 构建主题 UI 插件 bundle by @ruibaby in https://github.com/halo-dev/halo/pull/10057
- 支持通过插件为 FormKit 编写表单类型 by @ruibaby in https://github.com/halo-dev/halo/pull/10054
- 主题管理列表支持显示预览图 by @ruibaby in https://github.com/halo-dev/halo/pull/10049
- 在主题管理中删除主题时支持判断主题是否处于开发中，防止在本地开发主题时误删除 by @ruibaby in https://github.com/halo-dev/halo/pull/10003
- FormKit select 类型的选项支持设置图标和描述 by @ruibaby in https://github.com/halo-dev/halo/pull/10076
Full Changelog: https://github.com/halo-dev/halo/compare/v2.24.2...v2.25.0
Security Fixes
- Fixes bypass vulnerability in send email verification endpoint rate limiting (CVE not listed)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Halo
A powerful and easy-to-use website building tool (documentation in Chinese).
Beta — feedback welcome: [email protected]