CVE-2025-49000CWE-400CWE-770

InvenTree has uncontrolled memory allocation via built-in label-sheet plugin

Low · published June 3, 2025

CVSS v3.1
3.5
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.5th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-06-03T20:54Z
EPSS history
Timeline
  • 03 JUN 20:54Z
    InvenTree has uncontrolled memory allocation via built-in label-sheet plugin
    cvelistv5