CVE-2025-64868: Unauthenticated Payment Webhooks Cause Memory and Disk DoS via Unbounded Body Reads

Vulnerability Overview Title: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging Description: Unauthenticated payment webhook endpoints read and log the entire request body before verifying the webhook signature. When payment webhooks are enabled, unauthenticated attackers can send oversized requests to public callback endpoints, forcing excessive memory usage and log growth before the request is rejected. Affected Public Endpoints: Impact: A remote unauthenticated attacker can cause a service denial via memory pressure, container OOM restarts, or disk consumption. The impact is limited to availability and is rated as High. Affected Versions Affected Versions: Versions below are affected. The previously reported vulnerable version range was incomplete; anonymous request body limits were introduced later and first appeared in . Remediation Patch: The issue was fixed in . The fix involves adding and applying it to unauthenticated POST requests, including payment webhook callbacks. The default limit is controlled by , with a default value of 512 KB. Workarounds: If an immediate upgrade is not possible, operators should disable unused payment webhooks, enforce request body limits on the reverse proxy or load balancer, and ensure that application and container logs have rotation and quotas configured. These mitigations reduce exposure but do not replace the need to upgrade. References Fix Commit: Relevant Code Paths: - - - - - Additional Information CVE ID: CVE-2025-64868 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High Weaknesses: - CWE-400 - CWE-770 Credit: passer12 (Reporter)

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-64868: Unauthenticated Payment Webhooks Cause Memory and Disk DoS via Unbounded Body Reads

More from this source