Resource exhaustion in Invoke-Ai Invoke-Ai/invokeai
CVE-2024-11043
A Denial of Service (DoS) vulnerability was discovered in the /api/v1/boards/{board_id} endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occurs when an excessively large payload is sent in the board_name field during a PATCH request. By sending a large payload, the UI becomes unresponsive, rendering it impossible for users to interact with or manage the affected board. Additionally, the option to delete the board becomes inaccessible, amplifying the severity of the issue.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.007 (48.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Invoke-ai Invoke-ai/invokeai — versions unspecified
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-11043?
- CVE-2024-11043 is a high-severity vulnerability in Invoke-Ai Invoke-Ai/invokeai, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2025-03-20.
- How severe is CVE-2024-11043?
- High severity. CVSS v3 base score is 7.5 out of 10.