A Denial of Service (DoS) vulnerability exists in the file upload feature of haotian-liu/llava, specifically in Release v1.2.0 (LLaVA-1.6). The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. This issue can be exploited without authentication, making it highly scalable and increasing the risk of exploitation.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/8adac028-21c5-41ba-b785-b03066c0b2a6 | Exploit Third Party Advisory |
| https://huntr.com/bounties/8adac028-21c5-41ba-b785-b03066c0b2a6 | Exploit Third Party Advisory |
Configurations
History
14 Jul 2025, 17:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://huntr.com/bounties/8adac028-21c5-41ba-b785-b03066c0b2a6 - Exploit, Third Party Advisory | |
| First Time |
Hliu large Language And Vision Assistant
Hliu |
|
| CPE | cpe:2.3:a:hliu:large_language_and_vision_assistant:1.2.0:*:*:*:*:*:*:* |
20 Mar 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-14 17:45
NVD link : CVE-2024-12070
Mitre link : CVE-2024-12070
JSON object : View
Products Affected
hliu
- large_language_and_vision_assistant
CWE
No CWE.