Magento vulnerable to denial of service

CAO 7.5CVE-2025-49554 · GHSA-xgfm-992v-h2hr · Công bố 12/08/2025 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-49554 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng magento/community-edition, magento/project-community-edition, commerce (adobe).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.61%, cao hơn 49.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9-alpha2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
magento/community-edition Packagist	`= 2.4.5= 2.4.6= 2.4.7= 2.4.8≥ 2.4.6-p1, < 2.4.6-p12≥ 2.4.7-beta1, < 2.4.7-p7≥ 2.4.8-beta1, < 2.4.8-p2≥ 2.4.9-alpha1, < 2.4.9-alpha2< 2.4.5-p14`	`2.4.6-p122.4.7-p72.4.8-p22.4.9-alpha22.4.5-p14`
magento/project-community-edition Packagist	`≤ 2.0.2`	Chưa có bản vá
commerce adobe	`= 2.4.4= 2.4.5= 2.4.6= 2.4.7= 2.4.8< 2.4.4`	`2.4.4`
commerce b2b adobe	`= 1.3.3= 1.3.4= 1.3.5= 1.4.2= 1.5.2= 1.5.3< 1.3.3`	`1.3.3`
magento adobe	`= 2.4.5= 2.4.6= 2.4.7= 2.4.8= 2.4.9< 2.4.5`	`2.4.5`

Mô tả

Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.

Mô tả của NVD

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.