TI-2025-31029 Aliases CVE-2025-48879 GHSA-9wj4-8h85-pgrw

OctoPrint Vulnerable to Denial of Service through malformed HTTP request

LOW 28CWE-140Published 2025-06-10 · Updated 2025-06-10

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-835.

Summary

OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. The issue can be triggered by a broken multipart/form-data request lacking an end boundary to any of OctoPrint's endpoints implemented through the octoprint.server.util.tornado.UploadStorageFallbackHandler request handler. The request handler will get stuck in an endless busy loop, looking for a part of the request that will never come. As Tornado is single-threaded, that will effectively block the whole web server. The vulnerability has been patched in version 1.11.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00267 18th percentileScored 2026-11-07

Fix Fixed OctoPrint (OctoPrint): 1.11.2OctoPrint (PyPI): 1.11.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OctoPrint	OctoPrint	before 1.11.2	1.11.2	Patch available	CNA
—	OctoPrint (PyPI)	before 1.11.2	1.11.2	Patch available	GHSA-9wj4-8h85-pgrw

OctoPrint VendorOctoPrint Affected before 1.11.2 Fixed in 1.11.2 Patch available CNA
OctoPrint (PyPI) Vendor— Affected before 1.11.2 Fixed in 1.11.2 Patch available GHSA-9wj4-8h85-pgrw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:octoprint:octoprint::::::::	before 1.11.2	Vulnerable	OctoPrint

cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:* Versions before 1.11.2 Vulnerable ·OctoPrint

Remediation

Fix · CNA OctoPrint (OctoPrint) Fixed in 1.11.2
Fix · GHSA-9wj4-8h85-pgrw OctoPrint (PyPI) Fixed in 1.11.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-48879
2026-10-03 Alias added: GHSA-9wj4-8h85-pgrw

References

Patch 1

https://github.com/OctoPrint/OctoPrint/commit/c9c35c17bd820f19c6b12e6c0359fc0cfdd0c1ec

Advisory 2

Other 1

https://github.com/OctoPrint/OctoPrint

TI-2022-02830 Improper Privilege Management in octoprint/octoprint CVSS 3.1HIGH 8.8
TI-2022-03320 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint CVSS 3.1MEDIUM 6.0
TI-2022-02664 Unrestricted Upload of File with Dangerous Type in octoprint/octoprint CVSS 3.1MEDIUM 5.4
TI-2025-35988 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload CVSS 4.0HIGH 7.5
TI-2024-18796 OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings CVSS 3.1MEDIUM 4.8
TI-2022-02678 Insufficient Session Expiration in octoprint/octoprint CVSS 3.1MEDIUM 4.4

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences