{"id":"CVE-2024-45700","state":"PUBLISHED","title":"DoS vulnerability due to uncontrolled resource exhaustion","description":"Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash.","publishedAt":"2025-04-02T06:13:26.681Z","updatedAt":"2025-11-03T19:30:57.037Z","severity":{"score":6,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"Zabbix"},"assigner":"Zabbix","products":["Zabbix Zabbix"],"affected":[{"vendor":"Zabbix","product":"Zabbix","defaultStatus":"unaffected","versions":[{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.38","changes":[{"at":"6.0.39rc1","status":"unaffected"}],"versionType":"git"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.9","changes":[{"at":"7.0.10rc1","status":"unaffected"}],"versionType":"git"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","changes":[{"at":"7.2.4rc1","status":"unaffected"}],"versionType":"git"},{"version":"7.4.0alpha1","status":"unaffected","versionType":"git"}],"modules":["Zabbix Server","Zabbix Proxy"],"repo":"https://git.zabbix.com/"}],"references":["https://support.zabbix.com/browse/ZBX-26253","https://lists.debian.org/debian-lts-announce/2025/04/msg00027.html"],"weaknesses":["CWE-770"],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/45xxx/CVE-2024-45700.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-45700","state":"PUBLISHED","datePublished":"2025-04-02T06:13:26.681Z","dateUpdated":"2025-11-03T19:30:57.037Z","assignerShortName":"Zabbix","assignerOrgId":"72de3e22-0555-4a0d-ae81-9249e0f0a1e8","dateReserved":"2024-09-05T07:09:52.197Z"},"containers":{"cna":{"title":"DoS vulnerability due to uncontrolled resource exhaustion","descriptions":[{"lang":"en","value":"Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash."}],"affected":[{"vendor":"Zabbix","product":"Zabbix","defaultStatus":"unaffected","versions":[{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.38","changes":[{"at":"6.0.39rc1","status":"unaffected"}],"versionType":"git"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.9","changes":[{"at":"7.0.10rc1","status":"unaffected"}],"versionType":"git"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","changes":[{"at":"7.2.4rc1","status":"unaffected"}],"versionType":"git"},{"version":"7.4.0alpha1","status":"unaffected","versionType":"git"}],"modules":["Zabbix Server","Zabbix Proxy"],"repo":"https://git.zabbix.com/"}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-26253"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","baseScore":6,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"CWE-770 Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Zabbix","orgId":"72de3e22-0555-4a0d-ae81-9249e0f0a1e8","dateUpdated":"2025-04-02T06:13:26.681Z"},"credits":[{"lang":"en","type":"reporter","value":"Zabbix wants to thank kelsier for submitting this report on the HackerOne bug bounty platform"}],"impacts":[{"capecId":"CAPEC-130","descriptions":[{"lang":"en","value":"CAPEC-130 Excessive Allocation"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-02T16:27:38.059075Z","id":"CVE-2024-45700","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-02T16:27:54.190Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00027.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T19:30:57.037Z"}}]}}}