CVE-2025-48879: OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

June 10, 2025

OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. This could be used to effectively run a denial of service attack on the OctoPrint server.

References

github.com/OctoPrint/OctoPrint
github.com/OctoPrint/OctoPrint/commit/c9c35c17bd820f19c6b12e6c0359fc0cfdd0c1ec
github.com/OctoPrint/OctoPrint/security/advisories/GHSA-9wj4-8h85-pgrw
github.com/advisories/GHSA-9wj4-8h85-pgrw
nvd.nist.gov/vuln/detail/CVE-2025-48879

Code Behaviors & Features

Detect and mitigate CVE-2025-48879 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →