CVE-2025-49643 Frontend DoS vulnerability due to asymmetric resource consumption
An authenticated Zabbix user can cause server CPU exhaustion via crafted requests to imgstore.php, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-49643?
CVE-2025-49643 is a medium-severity denial of service vulnerability in Zabbix, published on 1 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.
Weakness: CWE-405
Which versions are affected by CVE-2025-49643?
It affects 1 product.
Products include Zabbix Frontend.
How do I fix CVE-2025-49643?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-49643 being exploited?
There is no known exploitation of CVE-2025-49643 in the wild and no public exploit code.
Other vulnerabilities in Zabbix
- CVE-2023-32725 Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
- CVE-2025-27232 Frontend arbitrary file read in oauth.authorize action
- CVE-2023-29457 Insufficient validation of Action form input fields
- CVE-2023-29456 Inefficient URL schema validation
- CVE-2023-29454 Persistent XSS in the user form
Sources
Also known as DEBIAN-CVE-2025-49643, GHSA-728r-qj99-48p2, UBUNTU-CVE-2025-49643.