CVE-2024-12074 MEDIUM

CVE-2024-12074: Denial of Service in automatic1111/stable-diffusion-webui

Vendor Automatic1111
Product automatic1111/stable-diffusion-webui
Weakness CWE-400
Published March 20, 2025
Last update March 20, 2025

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

A Denial of Service (DoS) vulnerability was discovered in the file upload feature of automatic1111/stable-diffusion-webui version 1.10.0. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. This issue can be exploited without authentication, making it highly scalable and increasing the risk of exploitation.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated