What’s Vulnerable › Vulnerabilities
CVE-2024-12070: Denial of Service in haotian-liu/llava
- Severity: high (CVSS 7.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.9% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-03-20 · updated 2026-06-17
- Weakness: CWE-400
Description
A Denial of Service (DoS) vulnerability exists in the file upload feature of haotian-liu/llava, specifically in Release v1.2.0 (LLaVA-1.6). The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. This issue can be exploited without authentication, making it highly scalable and increasing the risk of exploitation.
Affected products
References
- https://huntr.com/bounties/8adac028-21c5-41ba-b785-b03066c0b2a6
- https://huntr.com/bounties/8adac028-21c5-41ba-b785-b03066c0b2a6
Get alerted when CVE-2024-12070 or the next vulnerability affects your stack