CVE-2025-30151: Shopware Denial of Service Vulnerability

CVE-2025-30151 Overview

CVE-2025-30151 is a denial of service vulnerability affecting Shopware, an open commerce platform. Attackers can submit excessively long passwords through Storefront forms or the Store-API to trigger resource exhaustion. The flaw is tracked under [CWE-20: Improper Input Validation] and stems from missing length constraints on password fields during form processing.

Shopware addressed the issue in versions 6.6.10.3 and 6.5.8.17. Older 6.4 branches receive equivalent protection through a dedicated security plugin. The vulnerability requires no authentication and can be triggered remotely over the network.

Critical Impact
Unauthenticated attackers can exhaust server CPU and memory resources by submitting oversized password values to public-facing Shopware endpoints, rendering storefronts unavailable to legitimate customers.

Affected Products

Shopware versions prior to 6.6.10.3 on the 6.6.x branch
Shopware versions prior to 6.5.8.17 on the 6.5.x branch
Shopware 6.7.0.0-rc1 release candidate and older 6.4.x versions without the security plugin

Discovery Timeline

2025-04-08 - CVE-2025-30151 published to NVD
2025-09-10 - Last updated in NVD database

Technical Details for CVE-2025-30151

Vulnerability Analysis

The vulnerability resides in Shopware's password handling logic across Storefront forms and the Store-API. The platform accepts password input without enforcing a maximum length boundary before passing the value to downstream hashing operations. Password hashing algorithms such as bcrypt and Argon2 scale computational cost with input size.

When an attacker submits a password containing megabytes of data, the hashing routine consumes substantial CPU time and memory for each request. Repeated submissions amplify the effect across worker processes. The result is degraded availability for the storefront and API consumers.

The weakness falls under [CWE-20: Improper Input Validation]. It applies to any public endpoint that processes a password field, including registration forms, login endpoints, and password reset flows. Confidentiality and integrity remain unaffected because no credential disclosure or data tampering occurs.

Root Cause

Shopware did not enforce a maximum password length at the input validation layer. The framework forwarded arbitrary-length strings directly to the password hashing pipeline. Without a hard upper bound, resource consumption scales linearly with attacker-controlled input size.

Attack Vector

An attacker sends HTTP POST requests to any Shopware Storefront form or Store-API endpoint that accepts a password field. The request body contains a password value of extreme length. The server attempts to hash the value, consuming worker resources. Parallel requests from a single host or botnet quickly saturate available capacity and produce a denial of service condition.

The vulnerability is described in the Shopware GitHub Security Advisory.

Detection Methods for CVE-2025-30151

Indicators of Compromise

HTTP POST requests to /account/register, /account/login, or Store-API authentication endpoints with abnormally large request bodies
Sudden spikes in PHP-FPM worker CPU usage correlated with form submissions
Elevated response latency or 5xx errors on storefront authentication routes
Repeated requests from the same source IP targeting password-accepting endpoints

Detection Strategies

Inspect web server access logs for POST requests exceeding expected body sizes on authentication and registration paths
Monitor application performance metrics for PHP worker saturation tied to specific URL patterns
Deploy web application firewall rules that flag requests containing password parameters above a reasonable threshold such as 1024 bytes

Monitoring Recommendations

Forward Shopware application logs and reverse proxy access logs to a centralized SIEM for correlation
Alert on sustained increases in request rates targeting /account/* and /store-api/* endpoints
Track baseline request body sizes for authentication endpoints and trigger investigations on outliers

How to Mitigate CVE-2025-30151

Immediate Actions Required

Upgrade Shopware to version 6.6.10.3 or 6.5.8.17 immediately
For 6.4.x installations, install the corresponding Shopware security plugin until a full version upgrade is feasible
Apply reverse proxy or WAF rules that cap request body size and password parameter length until patching completes

Patch Information

Shopware released fixed builds 6.6.10.3 and 6.5.8.17 containing input length validation for password fields. Administrators running 6.4.x branches should apply the vendor-provided security plugin. Full remediation details are published in the GHSA-cgfj-hj93-rmh2 advisory.

Workarounds

Configure the upstream web server or load balancer to reject requests with bodies larger than expected for authentication forms
Apply rate limiting to /account/register, /account/login, and Store-API password endpoints to limit abuse from single sources
Deploy WAF signatures that block requests containing password fields exceeding 128 characters

bash

# Nginx example: limit request body size for storefront authentication paths
location ~ ^/(account|store-api)/ {
    client_max_body_size 16k;
    limit_req zone=auth_zone burst=10 nodelay;
    proxy_pass http://shopware_backend;
}

# Define the rate limit zone in the http block
# limit_req_zone $binary_remote_addr zone=auth_zone:10m rate=5r/s;