Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-8028Denial of Service in danswer-ai/danswer

High 7.5

In plain English

A high-severity resource allocation without limits in danswer-ai/danswer from danswer-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)0.5%top 55.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering the application inaccessible. This issue can be exploited by sending a single crafted request, affecting all users on the server.

Affected products (as reported)

Vendor	Product	Versions
danswer-ai	danswer-ai/danswer	unspecified – through latest

Weakness: CWE-770 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://huntr.com/bounties/55530ecb-0ac2-4dc1-9527-bf24de594a57