Adobe Commerce contains an Uncontrolled Resource Consumption (CWE-400) vulnerability affecting multiple versions up to and including 2.4.9-beta1. An unauthenticated attacker can exploit this issue remotely to consume excessive system resources, leading to denial-of-service conditions that disrupt application availability. The vulnerability does not impact confidentiality or integrity but solely affects availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope.

Successful exploitation results in denial-of-service by exhausting system resources, causing application unavailability. There is no impact on data confidentiality or integrity. This can disrupt business operations relying on Adobe Commerce but does not lead to data breaches or privilege escalation based on current information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor for unusual resource usage patterns and consider implementing resource limits or rate limiting where possible to mitigate potential denial-of-service attempts. No vendor-provided mitigation or workaround is currently available.