CVE-2025-49643 — Asymmetric Resource Consumption (Amplification) in Frontend

CWE-405 — Asymmetric Resource Consumption (Amplification)5 documents5 sources

Severity

6.0MEDIUMNVD

EPSS

0.1%

top 67.15%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zabbix Zabbix Frontend

Timeline

PublishedDec 1

Description

An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages3 packages

▶NVDzabbix/frontend6.0.0 — 6.0.42+3

▶Debianzabbix/zabbix< 1:7.0.22+dfsg-1~deb13u1+1

▶CVEListV5zabbix/zabbix6.0.0 — 6.0.41+3

🔴Vulnerability Details

OSV

CVE-2025-49643: An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to↗2025-12-01

▶

GHSA

GHSA-728r-qj99-48p2: An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to↗2025-12-01

▶

CVEList

Frontend DoS vulnerability due to asymmetric resource consumption↗2025-12-01

▶

📋Vendor Advisories

Debian

CVE-2025-49643: zabbix - An authenticated Zabbix user (including Guest) is able to cause disproportionate...↗2025

▶