Resource exhaustion in Lollms Web Ui
CVE-2025-1451
A vulnerability in parisneo/lollms-webui v13 arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate the length of the boundary or the characters appended to it, allowing an attacker to craft requests with excessively long boundaries, leading to resource exhaustion and eventual denial of service (DoS). Despite an attempted patch in commit 483431bb, which blocked hyphen characters from being appended to the multipart boundary, the fix is insufficient. The server remains vulnerable if other characters (e.g., '4', 'a') are used instead of hyphens. This allows attackers to exploit the vulnerability using different characters, causing resource exhaustion and service unavailability.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.006 (48.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 48.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Lollms Web Ui — versions 13
- Parisneo Parisneo/lollms-Webui — versions unspecified
Weakness classification (CWE)
References
- huntr.com/bounties/63f5aea4-953b-4b38-9f10-3afe425be1d4 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-1451?
- CVE-2025-1451 is a high-severity vulnerability in Lollms Web Ui, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2025-03-20.
- How severe is CVE-2025-1451?
- High severity. CVSS v3 base score is 7.5 out of 10.