Vulnerability · Published Jun 3, 2025 · Assigned by GitHub_M

CVE-2025-49000InvenTree has uncontrolled memory allocation via built-in label-sheet plugin

Low 3.5

In plain English

A low-severity uncontrolled resource consumption in InvenTree from inventree. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.4%top 70.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version.

Affected products (as reported)

Vendor	Product	Versions
inventree	InvenTree	< 0.17.13

Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

References

https://github.com/inventree/InvenTree/security/advisories/GHSA-m2ch-h84r-p9r6 x_refsource_CONFIRM
https://github.com/inventree/InvenTree/commit/0826a75ef6dde0ad96d680f52a9cf171ba2ce98b x_refsource_MISC
https://github.com/inventree/InvenTree/releases/tag/0.17.13 x_refsource_MISC