CVE-2024-10935: Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui
automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10935?
CVE-2024-10935 is considered to be of medium severity due to the potential for exploitation by malformed requests.
How do I fix CVE-2024-10935?
To mitigate CVE-2024-10935, update to the latest version of automatic1111/stable-diffusion-webui where the vulnerability is resolved.
What types of attacks can CVE-2024-10935 facilitate?
CVE-2024-10935 can facilitate denial-of-service attacks by exploiting the server's inability to handle excessive characters in multipart requests.
Which versions of software are affected by CVE-2024-10935?
CVE-2024-10935 affects automatic1111/stable-diffusion-webui version 1.10.0.
Is CVE-2024-10935 exploitable remotely?
Yes, CVE-2024-10935 is exploitable remotely since an attacker can send malformed multipart requests over the network.