Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-34649 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted requests to the affected Adobe Commerce application. These requests can consume excessive system resources, leading to a denial-of-service condition. Since the attack does not require user interaction, it can be executed remotely, making it easier for attackers to target vulnerable systems.
Affected Products
- Adobe Commerce 2.4.9-beta1
- Adobe Commerce 2.4.8-p4
- Adobe Commerce 2.4.7-p9
- Adobe Commerce 2.4.6-p14
- Adobe Commerce 2.4.5-p16
- Adobe Commerce 2.4.4-p17
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses the Uncontrolled Resource Consumption issue. Additionally, monitoring system resources and implementing rate limiting can help reduce the risk of denial-of-service attacks.