CVE-2025-49000

Katalog CVE

CVSS 5.7 · Medium EPSS 0,34%

Kerentanan Uncontrolled Resource Consumption pada inventree project inventree. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version.

Rincian

Terbit di NVD

3 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.7 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/inventree/InvenTree/security/advisories/GHSA-m2ch-h84r-p9r6 advisory vendor
• https://github.com/inventree/InvenTree/commit/0826a75ef6dde0ad96d680f52a9cf171ba2ce98b patch
• https://github.com/inventree/InvenTree/releases/tag/0.17.13 release notes