TI-2024-21093 Aliases CVE-2024-31994

Mealie vulnerable to a DoS in recipe image importer (GHSL-2023-228)

LOW 29CWE-400Published 2024-04-19 · Updated 2024-10-25

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie will attempt to retrieve this file in whole. If it can be retrieved, it may be stored on the file system in whole (leading to possible disk consumption), however the more likely scenario given resource limitations is that the container will OOM during file retrieval if the target file size is greater than the allocated memory of the container. At best this can be used to force the container to infinitely restart due to OOM (if so configured in `docker-compose.yml), or at worst this can be used to force the Mealie container to crash and remain offline. In the event that the file can be retrieved, the lack of rate limiting on this endpoint also permits an attacker to generate ongoing requests to any target of their choice, potentially contributing to an external-facing DoS attack. This vulnerability is fixed in 1.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00278 20th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed mealie (mealie-recipes): 1.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mealie-recipes	mealie	before 1.4.0	1.4.0	Patch available	CNA

mealie Vendormealie-recipes Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mealie:mealie::::::::	before 1.4.0	Vulnerable	mealie-recipes

cpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·mealie-recipes

Remediation

Fix · CNA mealie (mealie-recipes) Fixed in 1.4.0

Timeline

2026-10-02 Threatist record created from CVE-2024-31994

References

Exploit 1

https://securitylab.github.com/advisories/GHSL-2023-225_GHSL-2023-226_Mealie/

Patch 2

Other 1

https://github.com/mealie-recipes/mealie/blob/ee121a12f8db33ecb4db5f8582f7ea9788d019e4/mealie/services/recipe/recipe_data_service.py#L107

TI-2025-35411 Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe… CVSS 3.1CRITICAL 9.0
TI-2024-36768 A Broken Object Level Authorization vulnerability in the component /api/users/{user-id}… CVSS 3.1HIGH 7.6
TI-2024-21092 Mealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227) CVSS 3.1MEDIUM 6.2
TI-2025-43084 A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media… CVSS 3.1MEDIUM 6.1
TI-2025-43083 A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie… CVSS 3.1MEDIUM 5.4
TI-2024-36767 A Broken Object Level Authorization vulnerability in the component /api/users/{user-id}… CVSS 3.1MEDIUM 5.4

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences