CVE-2024-52581
Litestar allows unbounded resource consumption (DoS vulnerability)
Published Nov 20, 2024
CVSS 4.0 · 8.2 High
EPSS < 1%
KEV · Not listed
Description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to upload arbitrary large files wrapped in a `multipart/form-data` request and cause excessive memory consumption on the server. The multipart form parser in affected versions is vulnerable to this type of attack by design. The public method signature as well as its implementation both expect the entire request body to be available as a single byte string. It is not possible to accept large file uploads in a safe way using this parser. This may be a regression, as a variation of this issue was already reported in CVE-2023-25578. Limiting the part number is not sufficient to prevent out-of-memory errors on the server. A patch is available in version 2.13.0.
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| litestar-org | litestar | affected |
|
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-0214 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to upload arbitrary large files wrapped in a `multipart/form-data` request and cause excessive memory consumption on the server. The multipart form parser in affected versions is vulnerable to this type of attack by design. The public method signature as well as its implementation both expect the entire request body to be available as a single byte string. It is not possible to accept large file uploads in a safe way using this parser. This may be a regression, as a variation of this issue was already reported in CVE-2023-25578. Limiting the part number is not sufficient to prevent out-of-memory errors on the server. A patch is available in version 2.13.0. |
 Github GHSA |
GHSA-gjcc-jvgw-wvwj | Litestar allows unbounded resource consumption (DoS vulnerability) |
Metrics
Attack Vector Network
Attack Complexity Low
Privileges Required None
Attack Requirements Present
User Interaction None
Vulnerable System Confidentiality Impact None
Vulnerable System Integrity Impact None
Vulnerable System Availability Impact High
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact None
Subsequent System Availability Impact Low
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.794% probability within 30 days)
Exploitation poc
Automatable yes
Technical Impact partial
References
History
Nov 25, 2024 2:30 PM
References updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Nov 25, 2024 2:00 PM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Nov 22, 2024 10:00 PM
First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Litestar
Litestar litestar |
|
| CPEs | cpe:2.3:a:litestar:litestar:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Litestar
Litestar litestar |
|
| Metrics |
cvssV3_1
|
Nov 21, 2024 3:15 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Nov 21, 2024 2:15 PM
First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Litestar-org
Litestar-org litestar |
|
| CPEs | cpe:2.3:a:litestar-org:litestar:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Litestar-org
Litestar-org litestar |
|
| Metrics |
cvssV3_1
|
Nov 20, 2024 9:00 PM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to upload arbitrary large files wrapped in a `multipart/form-data` request and cause excessive memory consumption on the server. The multipart form parser in affected versions is vulnerable to this type of attack by design. The public method signature as well as its implementation both expect the entire request body to be available as a single byte string. It is not possible to accept large file uploads in a safe way using this parser. This may be a regression, as a variation of this issue was already reported in CVE-2023-25578. Limiting the part number is not sufficient to prevent out-of-memory errors on the server. A patch is available in version 2.13.0. | |
| Title | Litestar allows unbounded resource consumption (DoS vulnerability) | |
| Weaknesses | CWE-770 | |
| References |
|
|
| Metrics |
cvssV4_0
|
Weaknesses
