CVE-2024-9840

Summary

CVE-2024-9840 is a Denial of Service (DoS) vulnerability affecting open-webui version 0.3.21 and its multiple endpoints, including `/ollama/models/upload`, `/audio/api/v1/transcriptions`, and `/rag/api/v1/doc`. The issue lies in the application's failure to authenticate multipart boundaries, making it susceptible to resource exhaustion. An attacker can exploit this vulnerability by appending superfluous characters to the multipart boundary, causing the server to parse each byte, resulting in high CPU and memory usage. Consequently, the service becomes inaccessible to legitimate users, leading to significant service disruption.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.