{
  "schema_version": "1.4.0",
  "id": "GHSA-m76r-xqqj-mqmv",
  "modified": "2025-03-21T03:26:29Z",
  "published": "2025-03-20T12:32:50Z",
  "aliases": [
    "CVE-2024-9229"
  ],
  "summary": "Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary",
  "details": "A Denial of Service (DoS) vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive resource consumption by appending characters to the end of a multipart boundary in an HTTP request. This leads to the server continuously processing each character, rendering the service unavailable and impacting all users.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "quivr-core"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.0.14"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9229"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/QuivrHQ/quivr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QuivrHQ/quivr/blob/6b07a63e4e969d003710d6f6c6b9df36fd6ea803/backend/api/quivr_api/modules/upload/service/upload_file.py#L68-L101"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/946a412d-422f-4623-bb1d-d2646ad23dfd"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T03:26:29Z",
    "nvd_published_at": "2025-03-20T10:15:47Z"
  }
}