CVE-2025-1451

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-1451

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-1451.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-1451

Published

2025-03-20T10:10:49Z

Modified

2026-08-12T03:51:37Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Insufficient Patch Leading to DoS in parisneo/lollms-webui

Details

A vulnerability in parisneo/lollms-webui v13 arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate the length of the boundary or the characters appended to it, allowing an attacker to craft requests with excessively long boundaries, leading to resource exhaustion and eventual denial of service (DoS). Despite an attempted patch in commit 483431bb, which blocked hyphen characters from being appended to the multipart boundary, the fix is insufficient. The server remains vulnerable if other characters (e.g., '4', 'a') are used instead of hyphens. This allows attackers to exploit the vulnerability using different characters, causing resource exhaustion and service unavailability.

Database specific

{
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1451.json"
}

References

Affected packages

Git / github.com/parisneo/lollms-webui

Affected ranges

Type

GIT

Repo

https://github.com/parisneo/lollms-webui

Events

Introduced

57a3a7bab44a57ecdca8b395db67890878dadfd6

Last Affected

57a3a7bab44a57ecdca8b395db67890878dadfd6

Database specific

Show details

{
    "cpe": "cpe:2.3:a:lollms:lollms_web_ui:13:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "13"
        },
        {
            "last_affected": "13"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

Other

v13

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-1451.json"