CVE-2024-9229: Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary

March 20, 2025 (updated March 21, 2025)

A Denial of Service (DoS) vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive resource consumption by appending characters to the end of a multipart boundary in an HTTP request. This leads to the server continuously processing each character, rendering the service unavailable and impacting all users.

References

github.com/QuivrHQ/quivr
github.com/QuivrHQ/quivr/blob/6b07a63e4e969d003710d6f6c6b9df36fd6ea803/backend/api/quivr_api/modules/upload/service/upload_file.py
github.com/advisories/GHSA-m76r-xqqj-mqmv
huntr.com/bounties/946a412d-422f-4623-bb1d-d2646ad23dfd
nvd.nist.gov/vuln/detail/CVE-2024-9229

Code Behaviors & Features

Detect and mitigate CVE-2024-9229 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →