PT-2025-24683 · Octoprint · Octoprint

Jacopotediosi · Published 2025-06-10 · Updated 2025-08-12 · CVE-2025-48879

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OctoPrint versions up to and including 1.11.1

Description The issue allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint, making the web server component become unresponsive. This can be triggered by a broken request lacking an end boundary to any of OctoPrint's endpoints implemented through the octoprint.server.util.tornado.UploadStorageFallbackHandler request handler. The request handler will get stuck in an endless busy loop, looking for a part of the request that will never come, effectively blocking the whole web server due to Tornado being single-threaded.

Recommendations For versions up to and including 1.11.1, update to version 1.11.2 to resolve the issue. As a temporary workaround, consider restricting access to endpoints that use the octoprint.server.util.tornado.UploadStorageFallbackHandler request handler until the update can be applied.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

CWE-140

Related Identifiers

CVE-2025-48879

GHSA-9WJ4-8H85-PGRW

Affected Products

Octoprint

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48879.json · Exploit
• https://github.com/OctoPrint/OctoPrint/commit/c9c35c17bd820f19c6b12e6c0359fc0cfdd0c1ec · Patch
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-9wj4-8h85-pgrw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48879 · Security Note
• https://osv.dev/vulnerability/GHSA-9wj4-8h85-pgrw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48879 · Vendor Advisory
• https://github.com/OctoPrint/OctoPrint · Note
• https://t.me/cveNotify/131798 · Telegram Post
• https://twitter.com/CVEnew/status/1932465946708296035 · Twitter Post