High severity · published Mar 20, 2025
CVE-2024-10829
Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpt
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and complete denial of service for all users. This vulnerability affects all endpoints processing multipart/form-data requests.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EO
eosphoros-ai/db-gpt · eosphoros-ai
through latest · source: vendor
DB
Db-gpt · Dbgpt
0.6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10829
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10829
Exploit
https://huntr.com/bounties/e3a4a0ad-a2e0-497f-a2e0-e3c0ec7c4de4
More from eosphoros-ai/db-gpt
9.8
CVE-2024-10901
Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt
9.8
CVE-2024-10835
Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt
9.8
CVE-2024-10902
Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt
9.1
CVE-2024-10834
Arbitrary File Write in eosphoros-ai/db-gpt
9.1
CVE-2024-10833
Arbitrary File Write in eosphoros-ai/db-gpt