CVE-2024-10821: A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated…

PriorityP342high7.5CVSS 3.0

AVNACLPRNUINSUCNINAH

EPSS

0.59%

43.7th percentile

A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and a complete denial of service for all users. The affected endpoint is `/api/v1/images/upload`.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
invoke-ai	invoke-ai_invokeai	0 – 5.0.2	—
invoke-ai	invoke-ai_invokeai	unspecified – latest	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.