Technical impact
A Zammad instance that has not applied the 7.0.2 security update is vulnerable to a remote, unauthenticated denial of service attack. Sending a POST request to /api/v1/import/otrs/import_check triggers a retry loop that repeatedly attempts to contact an empty OTRS endpoint, sleeping 30 s plus 45 s between attempts. The loop blocks a Puma worker for roughly two minutes, forcing each request to consume almost no client resources while consuming server‑side worker resources. Repeated unauthenticated requests can saturate the worker pool and keep the service unavailable.
Affected Systems
Zammad helpdesk application, versions before 7.0.2 (including 7.0.1 and earlier). The flaw exists in the import controller that handles OTRS import checks and status actions.
Risk and Exploitability
The CVSS score of 8.7 indicates high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Attackers can launch the attack from any host with network connectivity to the Zammad server; no authentication or special configuration of the target is required beyond knowing the host name, and a CSRF token can be obtained from a normal GET request. Because each malicious POST consumes a worker for about 115 seconds, even a small volume of traffic can exhaust the Puma worker pool and render the application unusable.
