CVE-2025-49643
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Dec 1, 2025
CISA due date
—
The record
An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-97031 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a… CWE-405
- CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by… CWE-405
- CVE-2026-78659 When "Trailer" headers are sent by a client, the HTTP server internally uses the header… CWE-405
- CVE-2026-75029 In a query response, an attacker may send `named` multiple copies of a record that should… CWE-405
- CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS… CWE-405
- CVE-2026-84310 pypdf is a free and open-source pure-python PDF library. CWE-405
- CVE-2026-54874 Issue summary: Receiving a DTLS record for a future epoch while a handshake is in… CWE-405
- CVE-2026-23930 An unauthenticated user is able to cause disproportionate CPU load on the Frontend… CWE-405