UpHeron
All vulnerabilities

Servers and applications

CVE-2025-30151

Denial Of Service via password length

Severity
High 7.5
Published
8 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.5.8.17, 6.6.10.3
Also known as
GHSA-cgfj-hj93-rmh2
Sources
NVD, Project advisories (GitHub)

Description

Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Affected software

SoftwareAffected versions
ShopwareServers and applications · cpe:a:shopware:shopware
  • Every version before 6.5.8.17
  • From 6.6.0.0 before 6.6.10.3
  • Version 6.7.0.0-rc1
ShopwareServers and applications · github:shopware/shopware
  • Every version before 6.5.8.17
  • Version 6.7.0.0-rc1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-30151
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-30151
  • GitHub Advisory Database https://github.com/advisories/GHSA-cgfj-hj93-rmh2
  • github.com https://github.com/shopware/shopware/security/advisories/GHSA-cgfj-hj93-rmh2