Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-34648 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted requests to the affected Adobe Commerce application. By continuously sending these requests, the attacker can exhaust system resources, leading to a denial-of-service condition. This can be done without any user interaction, making it easier for attackers to target vulnerable systems.
Affected Products
- Adobe Commerce 2.4.9-beta1: Affected by resource consumption issues.
- Adobe Commerce 2.4.8-p4: Vulnerable to denial-of-service attacks.
- Adobe Commerce 2.4.7-p9: Exposed to uncontrolled resource consumption.
- Adobe Commerce 2.4.6-p14: Susceptible to application denial-of-service.
- Adobe Commerce 2.4.5-p16: Can be exploited for resource exhaustion.
- Adobe Commerce 2.4.4-p17: Vulnerable to denial-of-service conditions.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses the resource consumption issue. Additionally, implementing rate limiting and monitoring system resources can help prevent exploitation attempts.