GHSA-6f6x-f56q-5xgv

InvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`

Source: GitHub Advisory Database (reviewed) High CVE-2024-10821

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	InvokeAI	<= 5.0.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and a complete denial of service for all users. The affected endpoint is `/api/v1/images/upload`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-10821 advisory
https://github.com/invoke-ai/InvokeAI web
https://github.com/invoke-ai/InvokeAI/blob/807f458f13e7693ada2fb929c2d513950611fe9c/invokeai/app/api/routers/images.py#L29 web
https://huntr.com/bounties/0ac24835-c4c0-4f11-938a-d5641dfb80b2 web