What is GHSA-m76r-xqqj-mqmv?

GHSA-m76r-xqqj-mqmv is a security advisory published by GitHub Security Advisories with High severity. Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary

Which CVE IDs does GHSA-m76r-xqqj-mqmv cover?

GHSA-m76r-xqqj-mqmv covers the following CVE IDs: CVE-2024-9229. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m76r-xqqj-mqmv?

GHSA-m76r-xqqj-mqmv has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-m76r-xqqj-mqmv?

GHSA-m76r-xqqj-mqmv affects 1 product, including: pip/quivr-core:\u003c= 0.0.14.

GHSA-m76r-xqqj-mqmvHighCVSS 7.5

Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary

Vendor

GitHub Security Advisories

Published

March 20, 2025

Last Modified

October 15, 2025

🔗 CVE IDs covered (1)

CVE-2024-9229 →

📋 Description

A Denial of Service (DoS) vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive resource consumption by appending characters to the end of a multipart boundary in an HTTP request. This leads to the server continuously processing each character, rendering the service unavailable and impacting all users.

🎯 Affected products1

pip/quivr-core:<= 0.0.14

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-9229
https://huntr.com/bounties/946a412d-422f-4623-bb1d-d2646ad23dfd
https://github.com/QuivrHQ/quivr/blob/6b07a63e4e969d003710d6f6c6b9df36fd6ea803/backend/api/quivr_api/modules/upload/service/upload_file.py#L68-L101
https://github.com/advisories/GHSA-m76r-xqqj-mqmv