Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-10821Denial of Service (DoS) in invoke-ai/invokeai
High 7.5
In plain English
A high-severity infinite loop in invoke-ai/invokeai from invoke-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and a complete denial of service for all users. The affected endpoint is `/api/v1/images/upload`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | invokeai | no fix listed | GHSA-6f6x-f56q-5xgv |
| PyPI | invokeai | no fix listed | PYSEC-2026-1466 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| invoke-ai | invoke-ai/invokeai | unspecified – through latest |
Weakness: CWE-835 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H