An unauthenticated Denial of Service vulnerability in evershop 2.1.0 and prior allows remote attackers to exhaust system resources and crash the application server.

The application fails to properly limit the processing of SVG files via the GET /images API, specifically regarding shadow tree height and pattern tile dimensions. This flaw permits unauthenticated attackers to trigger unbounded resource consumption.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk due to the ease of exploitation. Successful exploitation results in system-wide denial of service, which disrupts critical business operations, prevents legitimate user access, and may necessitate emergency downtime for service restoration.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /images endpoint via network-level controls or block malicious traffic patterns.

Proactive Monitoring: Monitor server resource utilization (CPU and memory) and review access logs for high-frequency requests directed at the /images API.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and filter SVG file uploads or requests that exhibit signs of resource-intensive processing.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher write-up referenced by the CVE record.

Given the lack of an official patch and the potential for service disruption, organizations using evershop 2.1.0 or earlier must prioritize implementing the suggested compensating controls immediately. Restricting access to the vulnerable endpoint is the most effective way to mitigate this risk until a vendor-supplied update is released.