CVE-2024-9840: Denial of Service (DoS) Vulnerability in open-webui/open-webui
A Denial of Service (DoS) vulnerability exists in open-webui/open-webui version 0.3.21. This vulnerability affects multiple endpoints, including /ollama/models/upload, /audio/api/v1/transcriptions, and /rag/api/v1/doc. The application processes multipart boundaries without authentication, leading to resource exhaustion. By appending additional characters to the multipart boundary, an attacker can cause the server to parse each byte of the boundary, ultimately leading to service unavailability. This vulnerability can be exploited remotely, resulting in high CPU and memory usage, and rendering the service inaccessible to legitimate users.
Other sources
Rejected reason: REJECT DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-53981. Notes: All CVE users should reference CVE-2024-53981 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9840?
CVE-2024-9840 is classified as a Denial of Service (DoS) vulnerability.
How do I fix CVE-2024-9840?
To fix CVE-2024-9840, update the open-webui to a version beyond 0.3.21.
Which endpoints are affected by CVE-2024-9840?
CVE-2024-9840 affects the endpoints /ollama/models/upload, /audio/api/v1/transcriptions, and /rag/api/v1/doc.
What versions of open-webui are vulnerable to CVE-2024-9840?
Open-webui versions up to and including 0.3.21 are vulnerable to CVE-2024-9840.
What type of vulnerability is CVE-2024-9840?
CVE-2024-9840 is a Denial of Service (DoS) vulnerability that can disrupt application functionality.