CVE-2025-49554: Magento vulnerable to denial of service
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.
Other sources
Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.5-p14 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.6-p12 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.7-p7 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.8-p2 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.9-alpha2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49554?
CVE-2025-49554 is a high severity vulnerability that could cause application denial-of-service.
How do I fix CVE-2025-49554?
To mitigate CVE-2025-49554, ensure you upgrade affected versions of Adobe Commerce to the latest patched versions provided by Adobe.
Which versions of Adobe Commerce are affected by CVE-2025-49554?
CVE-2025-49554 affects Adobe Commerce versions up to and including 2.4.9-alpha1, as well as several previous versions.
What type of vulnerability is CVE-2025-49554?
CVE-2025-49554 is categorized as an Improper Input Validation vulnerability.
Can CVE-2025-49554 be exploited remotely?
Yes, an attacker can exploit CVE-2025-49554 remotely by sending specially crafted inputs.