Adobe Commerce and Magento Open Source Dependency on Vulnerable Third-Party Component Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Adobe Commerce and Magento Open Source versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier. This vulnerability arises from a dependency on a vulnerable third-party component, which an attacker could exploit to crash the application, leading to a denial-of-service condition. Notably, exploitation of this issue does not require user interaction.

Impact

Exploitation of this vulnerability could cause the application to crash, creating a denial-of-service condition.

Remediation

Users are advised to update to Adobe Commerce versions 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 or to Magento Open Source versions 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15.