Denial of Service Vulnerability in InvokeAI by Invoke AI
CVE-2024-11043

7.5HIGH

Key Information:

Vendor

Invoke-ai

Status
Invoke-ai/invokeai
Vendor
CVE Published:
20 March 2025

What is CVE-2024-11043?

A Denial of Service vulnerability has been identified in the /api/v1/boards/{board_id} endpoint of InvokeAI version v5.0.2. This vulnerability exploits the board_name field during a PATCH request by allowing excessively large payloads to be sent. As a result, the user interface becomes unresponsive, making it impossible for users to interact with or manage the affected board. Furthermore, the issue prevents users from deleting the board, thereby worsening the situation and impacting the overall functionality of the application.

Affected Version(s)

invoke-ai/invokeai <= unspecified

References

https://huntr.com/bounties/9270900a-b8b7-402f-aee5-432d89...

CVSS V3.0

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.