High severity · published Mar 20, 2025
CVE-2024-10935
Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
automatic1111/stable-diffusion-webui · automatic1111
through latest · source: vendor
ST
Stable-diffusion-webui · Automatic1111
1.10.0 · source: NVD
Affected product
AU
automatic1111/stable-diffusion-webui
automatic1111
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10935
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10935
Exploit
https://huntr.com/bounties/e6fdc6ed-f38d-4798-b60a-0e47893a81a6
More from automatic1111/stable-diffusion-webui
9.6
CVE-2024-11045
Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui
6.5
CVE-2024-12074
Denial of Service in automatic1111/stable-diffusion-webui
6.5
CVE-2024-12375
Local File Inclusion in automatic1111/stable-diffusion-webui
6.1
CVE-2024-11044
Open Redirect in automatic1111/stable-diffusion-webui
6.1
CVE-2024-12374
Stored XSS in automatic1111/stable-diffusion-webui
