CVE-2025-49643

Frontend DoS vulnerability due to asymmetric resource consumption

State: Published
Severity: 6.0 Medium
Published: Dec 1, 2025
Updated: Dec 1, 2025
Reserved: Jun 9, 2025

Description

An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.

Scores

CVSS	Score	Vector	Source
4.0	6.0 Medium	CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	Zabbix

Weaknesses

CWE-405 Asymmetric Resource Consumption (Amplification)

Affected Products

Product	Versions
ZabbixZabbix	6.0.0 through 6.0.41Affectedfrom 6.0.42Not affected 7.0.0 through 7.0.18Affectedfrom 7.0.19Not affected 7.2.0 through 7.2.12Affectedfrom 7.2.13Not affected 7.4.0 through 7.4.2Affectedfrom 7.4.3Not affected

References

https://support.zabbix.com/browse/ZBX-27284

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.