CVE-2024-8736
Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui
- State
- Published
- Severity
- 7.1 High
- Published
- Mar 20, 2025
- Updated
- Apr 4, 2025
- Reserved
- Sep 11, 2024
Description
A Denial of Service (DoS) vulnerability exists in multiple file upload endpoints of parisneo/lollms-webui version V12 (Strawberry). The vulnerability can be exploited remotely via Cross-Site Request Forgery (CSRF). Despite CSRF protection preventing file uploads, the application still processes multipart boundaries, leading to resource exhaustion. By appending additional characters to the multipart boundary, an attacker can cause the server to parse each byte of the boundary, ultimately leading to service unavailability. This vulnerability is present in the `/upload_avatar`, `/upload_app`, and `/upload_logo` endpoints.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.1 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H | @huntr_ai |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
parisneo/lollms-webuiparisneo |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.