CVE-2025-49643 - Frontend DoS vulnerability due to asymmetric resource consumption · CoreCVE

Back Back to CVE browser

MEDIUM

Frontend DoS vulnerability due to asymmetric resource consumption

Published Dec 1, 2025

6.0

MEDIUM

CVSS 4.0

EPSS 0.34%

Description

An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.

Affected products

Vendor Zabbix Product Zabbix Default
n/a
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.41
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.18
- Version
  7.2.0
  Status
  affected
  Constraints
  <=7.2.12
- Version
  7.4.0
  Status
  affected
  Constraints
  <=7.4.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
6.0.0	affected	<=6.0.41
7.0.0	affected	<=7.0.18
7.2.0	affected	<=7.2.12
7.4.0	affected	<=7.4.2

Remediation

Vendor solution

Update the affected components to their respective fixed versions.

Weaknesses (1)

CWE-405

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199985
Advisory
https://support.zabbix.com/browse/ZBX-27284
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199985		Advisory
https://support.zabbix.com/browse/ZBX-27284		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Zabbix

Published Dec 1, 2025

Updated Dec 1, 2025

Reserved Jun 9, 2025

Link CVE-2025-49643

CISA Vulnrichment

Updated Dec 1, 2025

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-49643

Severity n/a

Public date n/a

Links CVE-2025-49643

Assigner Zabbix

Published Dec 1, 2025

Updated Dec 1, 2025

Exploited since n/a

Link EUVD-2025-199985

EUVD-2025-199985