CVE-2024-7999: Denial of Service in open-webui/open-webui
A vulnerability in open-webui/open-webui version 79778fa allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering the application inaccessible. This issue can prevent all users from accessing the application until the server recovers.
Other sources
Rejected reason: REJECT DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-53981. Notes: All CVE users should reference CVE-2024-53981 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7999?
CVE-2024-7999 is classified as a Denial of Service (DoS) vulnerability.
How do I fix CVE-2024-7999?
To mitigate CVE-2024-7999, upgrade to version 0.4.7 of open-webui.
What causes CVE-2024-7999?
CVE-2024-7999 is caused by handling malformed multipart boundaries which can lead to excessive server resource consumption.
Which versions of open-webui are affected by CVE-2024-7999?
CVE-2024-7999 affects all versions of open-webui prior to 0.4.7.
Is there a known exploit for CVE-2024-7999?
While specific exploits are not detailed, the vulnerability allows attackers to overload the server through malformed file uploads.