Denial of Service (DoS) via Multipart Boundary in stangirard/quivr
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
A Denial of Service (DoS) vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive resource consumption by appending characters to the end of a multipart boundary in an HTTP request. This leads to the server continuously processing each character, rendering the service unavailable and impacting all users.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| stangirard | stangirard/quivr | up to latest | — | No fix listed | CNA |
| — | quivr-core (PyPI) | up to 0.0.14 | — | No fix listed | GHSA-m76r-xqqj-mqmv |
- stangirard/quivr Vendorstangirard Affected up to latest Fixed in — No fix listed CNA
- quivr-core (PyPI) Vendor— Affected up to 0.0.14 Fixed in — No fix listed GHSA-m76r-xqqj-mqmv
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:quivr:quivr:*:*:*:*:*:*:*:* | — | — | stangirard |
- cpe:2.3:a:quivr:quivr:*:*:*:*:*:*:*:* Versions — — ·stangirard
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-9229
- 2026-10-03 Alias added: GHSA-m76r-xqqj-mqmv
References
More stangirard vulnerabilities
- TI-2024-05458 Server-Side Request Forgery (SSRF) in stangirard/quivr CVSS 3.1HIGH 8.6
- TI-2024-04512 SSRF Vulnerability in stangirard/quivr CVSS 3.1HIGH 7.7
- TI-2024-05777 Stored XSS in stangirard/quivr CVSS 3.1MEDIUM 5.4
- TI-2024-06105 Path Traversal in stangirard/quivr CVSS 3.0MEDIUM 4.3
Sources
- CVE-2024-9229 · CVE Program
- CVE-2024-9229 · NVD
- FIRST EPSS
- GHSA-m76r-xqqj-mqmv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences