p PatchFirst

CVE-2024-10829

CVE-2024-10829 · Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpt

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and complete denial of service for all users. This vulnerability affects all endpoints processing multipart/form-data requests.

CVSS 7.5 · High · EPSS 0.7%

Published
Updated

Stack: python

Affected products and versions

  • eosphoros-ai/db-gpt

    Versions
    • ≥ unspecified, ≤ latest: Affected (custom)

    No fix published

  • dbgpt PyPI

    Versions
    • 0.4.7
    • 0.5.0
    • 0.5.1
    • 0.5.10
    • 0.5.1rc0
    • 0.5.2
    • 0.5.2rc0
    • 0.5.3
    • 0.5.3rc0
    • 0.5.4
    • 0.5.4rc0
    • 0.5.5
    • 0.5.5rc0
    • 0.5.6
    • 0.5.6rc0
    • 0.5.7
    • 0.5.7rc0
    • 0.5.8
    • 0.5.9
    • 0.5.9rc0
    Affected ranges
    • ECOSYSTEM: ≤ 0.6.0

    No fix published

Original sources

Check your server →