What’s Vulnerable › Vulnerabilities

CVE-2024-23826: Uploading an image with a specific filename causes a server-side DoS

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-29 · updated 2026-06-17
• Weakness: CWE-770

Description

spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is due to no limitation of the length of the filename and the costly use of the Unicode normalization with the form NFKD on Windows OS. This vulnerability was fixed in the 2024.01.29 release.

Affected products

• spbu-se spbu_se_site: before 2024.01.29 — fixed in 2024.01.29

How to fix

Upgrade to a fixed version: spbu-se spbu_se_site 2024.01.29. Check the vendor advisory for mitigations.

References

• https://github.com/spbu-se/spbu_se_site/commit/5ad623eb0405260763046343c5785bc588d8a57d
• https://github.com/spbu-se/spbu_se_site/security/advisories/GHSA-5vfc-v7hg-pvwm
• https://github.com/spbu-se/spbu_se_site/commit/5ad623eb0405260763046343c5785bc588d8a57d
• https://github.com/spbu-se/spbu_se_site/security/advisories/GHSA-5vfc-v7hg-pvwm

Get alerted when CVE-2024-23826 or the next vulnerability affects your stack