CVE-2024-10821 — Denial of Service (DoS) in invoke-ai/invokeai

CVE-2024-10821

Denial of Service (DoS) in invoke-ai/invokeai PUBLISHED

Description (CNA)

A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and a complete denial of service for all users. The affected endpoint is `/api/v1/images/upload`.

Affected (CNA)

Vendor / product	Versions
invoke-ai / invoke-ai/invokeai	affected unspecified through latest

CWE

CWE-835

References

https://huntr.com/bounties/0ac24835-c4c0-4f11-938a-d5641dfb80b2

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.