{"id":"CVE-2025-30151","aliases":["EUVD-2025-10291","GHSA-cgfj-hj93-rmh2"],"status":"published","title":"Shopware allows Denial Of Service via password length","description":"Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00425,"percentile":0.37252,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2025-04-08T13:46:30Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"Packagist","package":"shopware/core","fixed_in":["6.6.10.3","6.7.0.0-rc2","6.5.8.17"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"shopware/platform","fixed_in":["6.6.10.3","6.7.0.0-rc2","6.5.8.17"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0.0"},{"fixed":"6.6.10.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0.0"},{"fixed":"6.6.10.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0-rc1"},{"fixed":"6.7.0.0-rc2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0-rc1"},{"fixed":"6.7.0.0-rc2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.8.17"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.8.17"}]}]},{"source":"osv","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0.0"},{"fixed":"6.6.10.3"}]}],"versions":["v6.6.0.0","v6.6.0.1","v6.6.0.2","v6.6.0.3","v6.6.1.0","v6.6.1.1","v6.6.1.2","v6.6.10.0","v6.6.10.1","v6.6.10.2","v6.6.2.0","v6.6.3.0","v6.6.3.1","v6.6.4.0","v6.6.4.1","v6.6.5.0","v6.6.5.1","v6.6.6.0","v6.6.6.1","v6.6.7.0","v6.6.7.1","v6.6.8.0","v6.6.8.1","v6.6.8.2","v6.6.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0.0"},{"fixed":"6.6.10.3"}]}],"versions":["v6.6.0.0","v6.6.0.1","v6.6.0.2","v6.6.0.3","v6.6.1.0","v6.6.1.1","v6.6.1.2","v6.6.10.0","v6.6.10.1","v6.6.10.2","v6.6.2.0","v6.6.3.0","v6.6.3.1","v6.6.4.0","v6.6.4.1","v6.6.5.0","v6.6.5.1","v6.6.6.0","v6.6.6.1","v6.6.7.0","v6.6.7.1","v6.6.8.0","v6.6.8.1","v6.6.8.2","v6.6.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0-rc1"},{"fixed":"6.7.0.0-rc2"}]}],"versions":["v6.7.0.0-rc1"]},{"source":"osv","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0-rc1"},{"fixed":"6.7.0.0-rc2"}]}],"versions":["v6.7.0.0-rc1"]},{"source":"osv","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.8.17"}]}],"versions":["6.3.0.0","6.3.0.1","6.3.0.2","6.3.1.0","6.3.1.1","6.3.2.0","6.3.2.1","6.3.3.0","6.3.3.1","6.3.4.0","6.3.4.1","6.3.5.0","6.3.5.1","6.3.5.2","6.3.5.3","6.3.5.4","6.4.0.0","6.4.0.0-RC1","6.4.1.0","6.4.1.1","6.4.1.2","6.4.10.0","6.4.10.1","6.4.11.0","6.4.11.1","6.4.12.0","6.4.13.0","6.4.14.0","6.4.15.0","6.4.15.1","6.4.15.2","6.4.16.0","6.4.16.1","6.4.17.0","6.4.17.1","6.4.17.2","6.4.18.0","6.4.18.1","6.4.19.0","6.4.2.0","6.4.2.1","6.4.20.0","6.4.20.1","6.4.20.2","6.4.3.0","6.4.3.1","6.4.4.0","6.4.4.1","6.4.5.0","6.4.5.1","6.4.6.0","6.4.6.1","6.4.7.0","6.4.8.0","6.4.8.1","6.4.8.2","6.4.9.0","6.5.0.0","6.5.0.0-rc1","6.5.0.0-rc2","6.5.0.0-rc3","6.5.0.0-rc4","v6.0.0+ea2","v6.1.0","v6.1.0-rc1","v6.1.0-rc2","v6.1.0-rc3","v6.1.0-rc4","v6.1.1","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.1.6","v6.2.0","v6.2.0-RC1","v6.2.1","v6.2.2","v6.2.3","v6.5.1.0","v6.5.1.1","v6.5.2.0","v6.5.2.1","v6.5.3.0","v6.5.3.1","v6.5.3.2","v6.5.3.3","v6.5.4.0","v6.5.4.1","v6.5.5.0","v6.5.5.1","v6.5.5.2","v6.5.6.0","v6.5.6.1","v6.5.7.0","v6.5.7.1","v6.5.7.2","v6.5.7.3","v6.5.7.4","v6.5.8.0","v6.5.8.1","v6.5.8.10","v6.5.8.11","v6.5.8.12","v6.5.8.13","v6.5.8.14","v6.5.8.15","v6.5.8.16","v6.5.8.2","v6.5.8.3","v6.5.8.4","v6.5.8.5","v6.5.8.6","v6.5.8.7","v6.5.8.8","v6.5.8.9"]},{"source":"osv","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.8.17"}]}],"versions":["6.3.0.0","6.3.0.1","6.3.0.2","6.3.1.0","6.3.1.1","6.3.2.0","6.3.2.1","6.3.3.0","6.3.3.1","6.3.4.0","6.3.4.1","6.3.5.0","6.3.5.1","6.3.5.2","6.3.5.3","6.3.5.4","6.4.0.0","6.4.0.0-RC1","6.4.1.0","6.4.1.1","6.4.1.2","6.4.10.0","6.4.10.1","6.4.11.0","6.4.11.1","6.4.12.0","6.4.13.0","6.4.14.0","6.4.15.0","6.4.15.1","6.4.15.2","6.4.16.0","6.4.16.1","6.4.17.0","6.4.17.1","6.4.17.2","6.4.18.0","6.4.18.1","6.4.19.0","6.4.2.0","6.4.2.1","6.4.20.0","6.4.20.1","6.4.20.2","6.4.3.0","6.4.3.1","6.4.4.0","6.4.4.1","6.4.5.0","6.4.5.1","6.4.6.0","6.4.6.1","6.4.7.0","6.4.8.0","6.4.8.1","6.4.8.2","6.4.9.0","6.5.0.0","6.5.0.0-rc1","6.5.0.0-rc2","6.5.0.0-rc3","6.5.0.0-rc4","v6.0.0+ea2","v6.1.0","v6.1.0-rc1","v6.1.0-rc2","v6.1.0-rc3","v6.1.0-rc4","v6.1.1","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.1.6","v6.2.0","v6.2.0-RC1","v6.2.1","v6.2.2","v6.2.3","v6.5.1.0","v6.5.1.1","v6.5.2.0","v6.5.2.1","v6.5.3.0","v6.5.3.1","v6.5.3.2","v6.5.3.3","v6.5.4.0","v6.5.4.1","v6.5.5.0","v6.5.5.1","v6.5.5.2","v6.5.6.0","v6.5.6.1","v6.5.7.0","v6.5.7.1","v6.5.7.2","v6.5.7.3","v6.5.7.4","v6.5.8.0","v6.5.8.1","v6.5.8.10","v6.5.8.11","v6.5.8.12","v6.5.8.13","v6.5.8.14","v6.5.8.15","v6.5.8.16","v6.5.8.2","v6.5.8.3","v6.5.8.4","v6.5.8.5","v6.5.8.6","v6.5.8.7","v6.5.8.8","v6.5.8.9"]}],"products":[{"vendor":"shopware","product":"shopware"}],"references":[{"url":"https://github.com/shopware/shopware/security/advisories/GHSA-cgfj-hj93-rmh2","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/shopware/shopware/releases/tag/v6.5.8.17","tags":["web"]},{"url":"https://github.com/shopware/shopware/releases/tag/v6.6.10.3","tags":["web"]},{"url":"https://github.com/shopware/shopware/releases/tag/v6.7.0.0-rc2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30151","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cgfj-hj93-rmh2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30151.json","tags":["advisory"]},{"url":"https://github.com/shopware/shopware","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-30151","title":"Shopware allows Denial Of Service via password length","description":"Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.","status":"published","published":"2025-04-08T13:46:30.629Z","modified":"2025-04-08T18:47:54.011Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2025-10291","description":"Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.","status":"published","published":"2025-04-08T13:46:30Z","modified":"2025-04-08T18:47:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:39.117101Z"}],"ghsa":[{"id":"GHSA-cgfj-hj93-rmh2","title":"Shopware allows Denial Of Service via password length","description":"### Impact\n\nIt's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API.\n\n### Patches\nUpdate to Shopware 6.6.10.3 or 6.5.8.17\n\n### Workarounds\nFor older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.","status":"published","published":"2025-04-08T14:51:17Z","modified":"2025-04-08T17:48:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:38.344711Z"}],"nvd":[{"id":"CVE-2025-30151","description":"Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.","status":"published","published":"2025-04-08T14:15:34.737Z","modified":"2026-06-17T09:08:15.39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:10:59.48027Z"}],"osv":[{"id":"CVE-2025-30151","title":"Shopware allows Denial Of Service via password length","description":"Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.","status":"published","published":"2025-04-08T13:46:30.629Z","modified":"2026-10-28T02:30:25.489645071Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-cgfj-hj93-rmh2","title":"Shopware allows Denial Of Service via password length","description":"### Impact\n\nIt's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API.\n\n### Patches\nUpdate to Shopware 6.6.10.3 or 6.5.8.17\n\n### Workarounds\nFor older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.","status":"published","published":"2025-04-08T14:51:17Z","modified":"2025-04-08T18:13:12.572093Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}