PT-2025-12272 · Unknown · Stangirard/Quivr

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-9229

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions stangirard/quivr version 0.0.298

Description A Denial of Service (DoS) issue in the file upload feature allows unauthenticated attackers to consume resources excessively by appending characters to the end of a multipart boundary in an HTTP request. This causes the server to continuously process each character, rendering the service unavailable and impacting all users.

Recommendations For stangirard/quivr version 0.0.298, consider disabling the file upload feature until a patch is available to prevent excessive resource consumption. Restrict access to the multipart boundary in HTTP requests to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2024-9229

GHSA-M76R-XQQJ-MQMV

Affected Products

Stangirard/Quivr

References · 6

• https://osv.dev/vulnerability/GHSA-m76r-xqqj-mqmv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9229 · Security Note
• https://github.com/QuivrHQ/quivr/blob/6b07a63e4e969d003710d6f6c6b9df36fd6ea803/backend/api/quivr_api/modules/upload/service/upload_file.py#L68-L101 · Note
• https://github.com/QuivrHQ/quivr · Note
• https://twitter.com/CVEnew/status/1902671083473695148 · Twitter Post
• https://huntr.com/bounties/946a412d-422f-4623-bb1d-d2646ad23dfd · Note