CVE-2025-49000: InvenTree has uncontrolled memory allocation via built-in label-sheet plugin
InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in label-sheet plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49000?
CVE-2025-49000 is considered a medium severity vulnerability due to the potential for denial of service caused by large input values.
How do I fix CVE-2025-49000?
To fix CVE-2025-49000, update InvenTree to version 0.17.13 or later.
What type of vulnerability is CVE-2025-49000?
CVE-2025-49000 is a denial of service vulnerability affecting the label-sheet plugin in InvenTree.
Who is affected by CVE-2025-49000?
Any authenticated user of the label-printing function in InvenTree versions prior to 0.17.13 is affected by CVE-2025-49000.
What component of InvenTree does CVE-2025-49000 target?
CVE-2025-49000 targets the built-in label-sheet plugin in InvenTree.