PT-2025-12272 · Unknown · Stangirard/Quivr

CVE-2024-9229 · Published 2025-03-20 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions stangirard/quivr version 0.0.298

Description A Denial of Service (DoS) issue in the file upload feature allows unauthenticated attackers to consume resources excessively by appending characters to the end of a multipart boundary in an HTTP request. This causes the server to continuously process each character, rendering the service unavailable and impacting all users.

Recommendations For stangirard/quivr version 0.0.298, consider disabling the file upload feature until a patch is available to prevent excessive resource consumption. Restrict access to the multipart boundary in HTTP requests to minimize the risk of exploitation.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2024-9229

GHSA-M76R-XQQJ-MQMV

PYSEC-2026-1861

Affected Products

Stangirard/Quivr

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-9229 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-1861 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m76r-xqqj-mqmv · Vendor Advisory
• https://github.com/QuivrHQ/quivr · Note
• https://github.com/QuivrHQ/quivr/blob/6b07a63e4e969d003710d6f6c6b9df36fd6ea803/backend/api/quivr_api/modules/upload/service/upload_file.py#L68-L101 · Note
• https://github.com/advisories/GHSA-m76r-xqqj-mqmv · Note
• https://huntr.com/bounties/946a412d-422f-4623-bb1d-d2646ad23dfd · Note
• https://twitter.com/CVEnew/status/1902671083473695148 · Twitter Post
• https://pypi.org/project/quivr-core · Note