CVE-2025-67419
Published: 05 January 2026
Summary
CVE-2025-67419 is a high-severity Excessive Platform Resource Consumption within a Loop (CWE-1050) vulnerability in Evershop Evershop. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing web API endpoint directly enables remote unauthenticated exploitation for application-layer DoS via crafted input triggering resource exhaustion.
NVD Description
A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions…
more
of pattern tiles during the processing of SVG files, resulting in unbounded resource consumption and system-wide denial of service.
Deeper analysisAI
CVE-2025-67419 is a Denial of Service (DoS) vulnerability in Evershop versions 2.1.0 and prior. The flaw occurs in the "GET /images" API endpoint, where the application processes SVG files without limiting the height of the use-element shadow tree or the dimensions of pattern tiles. This deficiency enables unbounded resource consumption on the application server, published on 2026-01-05 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and mapped to CWE-1050.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction or privileges required. By sending a malicious request to the "GET /images" API containing a crafted SVG file, attackers can trigger excessive resource usage, exhausting the server's CPU or memory and causing a system-wide denial of service that disrupts availability for legitimate users.
Advisories and related resources are available at https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2025-67419, which documents the issue, and the Evershop project repository at https://github.com/evershopcommerce/evershop.
Details
- CWE(s)