CVE-2025-30151: Shopware Denial of Service via Password Length
Summary
CVE-2025-30151: Shopware allows Denial Of Service via password length. Affects shopware/core across 3 version ranges.
< 6.5.8.17
>= 6.6.0.0, < 6.6.10.3
>= 6.7.0.0-rc1, < 6.7.0.0-rc2
Fixed in 6.5.8.17, 6.6.10.3 or 6.7.0.0-rc2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is an open-source e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and various integrations. However, it is susceptible to a Denial of Service (DoS) vulnerability due to the lack of restrictions on password length, which can be exploited through Storefront forms or the Store-API.
Vulnerability Detail
The vulnerability arises from the ability to submit excessively long passwords, which can overwhelm the system and lead to a Denial of Service. This can affect the availability of the application, making it unresponsive to legitimate users. The issue is classified under CWE-20, indicating improper input validation, and has a CVSS score of 7.5, highlighting its severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.5.8.176.5.8.17composer require shopware/core:6.5.8.17 -
>= 6.6.0.0, < 6.6.10.36.6.10.3composer require shopware/core:6.6.10.3 -
>= 6.7.0.0-rc1, < 6.7.0.0-rc26.7.0.0-rc2composer require shopware/core:6.7.0.0-rc2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For users on older versions of Shopware 6.4, a plugin is available that implements security measures to mitigate this vulnerability. It is recommended to install this plugin until an upgrade to the latest version can be performed.
Conclusion
In summary, the CVE-2025-30151 vulnerability in Shopware allows for Denial of Service attacks through long password submissions. It is crucial to update to the latest patched versions or implement available workarounds to ensure the security and availability of your Shopware installation.
See every vulnerability recorded for shopware/core →
FAQ
The vulnerability allows for Denial of Service attacks through excessively long passwords submitted via forms.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary consequence is a Denial of Service, which can render the application unresponsive to legitimate users.
Yes, a plugin is available for Shopware 6.4 that implements security measures to mitigate the vulnerability.
If immediate updating is not possible, consider using the available plugin for older versions to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for shopware/core.
