CVE-2025-1451: Insufficient Patch Leading to DoS in parisneo/lollms-webui
First published: Thu Mar 20 2025(Updated: )
A vulnerability in parisneo/lollms-webui v13 arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate the length of the boundary or the characters appended to it, allowing an attacker to craft requests with excessively long boundaries, leading to resource exhaustion and eventual denial of service (DoS). Despite an attempted patch in commit 483431bb, which blocked hyphen characters from being appended to the multipart boundary, the fix is insufficient. The server remains vulnerable if other characters (e.g., '4', 'a') are used instead of hyphens. This allows attackers to exploit the vulnerability using different characters, causing resource exhaustion and service unavailability.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| parisneo lollms | ||
| Lollms | =13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-1451?
CVE-2025-1451 is rated as a high severity vulnerability due to its potential to allow crafted requests that could exploit server limitations.
How do I fix CVE-2025-1451?
To fix CVE-2025-1451, implement input validation to limit the length and character set of multipart boundaries in file uploads.
What types of attacks can exploit CVE-2025-1451?
CVE-2025-1451 can be exploited to perform Denial of Service attacks or potentially gain unauthorized access through crafted requests.
Which software is affected by CVE-2025-1451?
CVE-2025-1451 affects the parisneo/lollms-webui v13 application.
Is there a patch available for CVE-2025-1451?
As of now, specific patch details for CVE-2025-1451 should be checked in the software vendor's updates or security advisories.
- agent/references
- agent/title
- agent/weakness
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- vendor/parisneo
- canonical/parisneo lollms
- vendor/lollms
- canonical/lollms
- version/lollms/13