Log in Start free

Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-10935Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui

High 7.5

In plain English

A high-severity resource allocation without limits in automatic1111/stable-diffusion-webui from automatic1111. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High
Exploit odds (30 days)0.8%top 42.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.

Affected products (as reported)

VendorProductVersions
automatic1111 automatic1111/stable-diffusion-webui unspecified – through latest

Weakness: CWE-770 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References