A vulnerability in parisneo/lollms-webui v13 arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate the length of the boundary or the characters appended to it, allowing an attacker to craft requests with excessively long boundaries, leading to resource exhaustion and eventual denial of service (DoS). Despite an attempted patch in commit 483431bb, which blocked hyphen characters from being appended to the multipart boundary, the fix is insufficient. The server remains vulnerable if other characters (e.g., '4', 'a') are used instead of hyphens. This allows attackers to exploit the vulnerability using different characters, causing resource exhaustion and service unavailability.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/63f5aea4-953b-4b38-9f10-3afe425be1d4 | Exploit Third Party Advisory |
Configurations
History
27 Mar 2025, 15:40
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:lollms:lollms_web_ui:13:*:*:*:*:*:*:* | |
| References | () https://huntr.com/bounties/63f5aea4-953b-4b38-9f10-3afe425be1d4 - Exploit, Third Party Advisory | |
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Lollms
Lollms lollms Web Ui |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-03-27 15:40
NVD link : CVE-2025-1451
Mitre link : CVE-2025-1451
JSON object : View
Products Affected
lollms
- lollms_web_ui
CWE