Vulnerability Description
A Denial of Service (DoS) vulnerability exists in the file upload feature of haotian-liu/llava, specifically in Release v1.2.0 (LLaVA-1.6). The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. This issue can be exploited without authentication, making it highly scalable and increasing the risk of exploitation.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hliu | Large Language And Vision Assistant | 1.2.0 |
Related Weaknesses (CWE)
References
- https://huntr.com/bounties/8adac028-21c5-41ba-b785-b03066c0b2a6ExploitThird Party Advisory
- https://huntr.com/bounties/8adac028-21c5-41ba-b785-b03066c0b2a6ExploitThird Party Advisory
FAQ
What is CVE-2024-12070?
CVE-2024-12070 is a vulnerability with a CVSS score of 7.5 (HIGH). A Denial of Service (DoS) vulnerability exists in the file upload feature of haotian-liu/llava, specifically in Release v1.2.0 (LLaVA-1.6). The vulnerability is due to improper handling of form-data w...
How severe is CVE-2024-12070?
CVE-2024-12070 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-12070?
Check the references section above for vendor advisories and patch information. Affected products include: Hliu Large Language And Vision Assistant.