Adobe Commerce and Magento Open Source Dependency on Vulnerable Third-Party Component Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Adobe Commerce and Magento Open Source versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier. This vulnerability arises from a dependency on a vulnerable third-party component, which an attacker could exploit to crash the application, causing a denial-of-service condition. Notably, exploitation of this issue does not require user interaction.

Impact

Exploitation of this vulnerability leads to an application denial-of-service, causing the application to crash and become unresponsive.

Remediation

Users are advised to update to Adobe Commerce versions 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 or to Magento Open Source versions 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15.