Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-10051Unauthenticated Denial of Service in shaunwei/realchar

High 7.5

In plain English

A high-severity resource allocation without limits in shaunwei/realchar from shaunwei. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)0.6%top 52.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Realchar version v0.0.4 is vulnerable to an unauthenticated denial of service (DoS) attack. The vulnerability exists in the file upload request handling, where appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request causes the server to continuously process each character. This leads to excessive resource consumption and renders the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.

Affected products (as reported)

Vendor	Product	Versions
shaunwei	shaunwei/realchar	unspecified – through latest

Weakness: CWE-770 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://huntr.com/bounties/6db72368-e7bc-43ee-a4ae-6092f710c263