CVE-2025-49554: Adobe Commerce DoS Vulnerability

CVE-2025-49554 Overview

CVE-2025-49554 is an Improper Input Validation vulnerability [CWE-20] affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows an unauthenticated remote attacker to send specially crafted input that causes the application to crash or become unresponsive, resulting in denial of service. Exploitation requires no user interaction and no privileges, making the vulnerability reachable directly over the network. Affected versions include Adobe Commerce 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14, and earlier releases. Adobe published guidance in advisory APSB25-71.

Critical Impact
Unauthenticated attackers can disrupt Adobe Commerce storefronts and B2B portals, taking online sales channels offline without authentication or user interaction.

Affected Products

Adobe Commerce (2.4.4 through 2.4.9-alpha1 release branches, including 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14, and earlier)
Adobe Commerce B2B (1.3.3 through 1.5.3-alpha1 release branches)
Magento Open Source (2.4.5 through 2.4.9-alpha1 release branches)

Discovery Timeline

2025-08-12 - CVE-2025-49554 published to the National Vulnerability Database
2025-08-15 - CVE-2025-49554 last updated in NVD

Technical Details for CVE-2025-49554

Vulnerability Analysis

CVE-2025-49554 is classified as Improper Input Validation [CWE-20] leading to application denial of service. Adobe Commerce fails to adequately validate attacker-supplied input before processing it through downstream logic. When the malformed input reaches a sensitive code path, the application enters an error state and crashes or stops responding to further requests.

The impact is confined to availability. Confidentiality and integrity of stored data remain intact, but customer-facing storefronts, checkout flows, and B2B portals become unreachable until the application is restarted or recovered. For commerce platforms tied directly to revenue, the outage window translates into measurable financial loss.

No public exploit code or proof-of-concept has been published at the time of writing, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is insufficient validation of attacker-controlled input fields before they are consumed by Adobe Commerce request handling logic. Adobe has not publicly disclosed the specific component or endpoint, but the weakness pattern matches a class of input handlers that propagate malformed values into resource-intensive or assertion-bound code paths.

Attack Vector

The vulnerability is exploitable over the network with no authentication and no user interaction required. An attacker sends a specially crafted HTTP request containing malformed input to a publicly exposed Adobe Commerce instance. Processing the crafted payload causes the PHP application worker to crash or hang, denying service to legitimate shoppers and administrators.

Technical specifics of the vulnerable endpoint and payload format are not disclosed in the public advisory. Refer to the Adobe Magento Security Advisory APSB25-71 for vendor-provided detail and patch metadata.

Detection Methods for CVE-2025-49554

Indicators of Compromise

Unexpected PHP-FPM worker crashes, segmentation faults, or fatal error log entries in var/log/exception.log and var/log/system.log correlated with inbound HTTP requests.
Spikes in HTTP 5xx responses (500, 502, 503) from the storefront or /rest/, /graphql, and admin endpoints originating from a small set of source IPs.
Repeated requests carrying anomalous payload structures, oversized fields, or malformed parameter encodings against Adobe Commerce endpoints.

Detection Strategies

Monitor web application firewall (WAF) and reverse proxy logs for repeated malformed requests followed by backend timeouts or worker restarts.
Baseline normal request volume and error rates per endpoint, then alert on deviations consistent with availability-impacting probes.
Correlate Adobe Commerce application crashes with upstream source IP reputation and request fingerprinting to surface targeted DoS attempts.

Monitoring Recommendations

Forward Adobe Commerce application logs, PHP-FPM logs, and web server access logs to a centralized SIEM or data lake for correlation.
Track availability metrics (response time, error rate, worker saturation) per Adobe Commerce node and alert on regressions.
Watch for repeated requests from non-customer geographies or known scanner infrastructure targeting Magento URLs such as /rest/V1/, /graphql, and /admin.

How to Mitigate CVE-2025-49554

Immediate Actions Required

Inventory all Adobe Commerce, Commerce B2B, and Magento Open Source instances and identify versions at or below 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, and 2.4.4-p14.
Apply the patches referenced in Adobe Security Bulletin APSB25-71 to all affected production and staging systems.
Place affected storefronts behind a WAF with input validation and rate-limiting rules until patches are deployed.
Enable automated restart of crashed PHP-FPM workers to reduce mean time to recovery during attempted exploitation.

Patch Information

Adobe released fixed builds as part of security bulletin APSB25-71. Operators should upgrade to the patched releases listed in the bulletin for each affected branch (2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, and 2.4.9), as well as the corresponding Commerce B2B updates. Validate the upgrade in a staging environment, run database upgrade scripts, and clear caches before promoting to production.

Workarounds

Deploy WAF rules to drop or rate-limit requests carrying malformed payloads, oversized parameters, or anomalous content types against Adobe Commerce endpoints.
Restrict administrative endpoints (/admin, /rest/V1/) to known IP ranges through network ACLs or reverse proxy configuration.
Configure aggressive PHP-FPM pm.max_requests and process supervision so crashed workers are recycled quickly to maintain availability.

bash

# Configuration example
# Refer to Adobe Security Bulletin APSB25-71 for vendor-supplied patch steps.
# See: https://helpx.adobe.com/security/products/magento/apsb25-71.html