Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-11043Denial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeai
High 7.5
In plain English
A high-severity uncontrolled resource consumption in invoke-ai/invokeai from invoke-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
A Denial of Service (DoS) vulnerability was discovered in the /api/v1/boards/{board_id} endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occurs when an excessively large payload is sent in the board_name field during a PATCH request. By sending a large payload, the UI becomes unresponsive, rendering it impossible for users to interact with or manage the affected board. Additionally, the option to delete the board becomes inaccessible, amplifying the severity of the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | invokeai | no fix listed | GHSA-ffh5-w482-c7m5 |
| PyPI | invokeai | no fix listed | PYSEC-2026-1467 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| invoke-ai | invoke-ai/invokeai | unspecified – through latest |
Weakness: CWE-400 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H