CVE-2024-12070 in llava
Summary
by MITRE • 03/20/2025
A Denial of Service (DoS) vulnerability exists in the file upload feature of haotian-liu/llava, specifically in Release v1.2.0 (LLaVA-1.6). The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. This issue can be exploited without authentication, making it highly scalable and increasing the risk of exploitation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/14/2025
The vulnerability described in CVE-2024-12070 represents a critical denial of service weakness within the LLaVA-1.6 framework, specifically affecting the file upload functionality. This issue stems from inadequate input validation mechanisms that fail to properly process form-data containing excessively long filenames. The vulnerability exists in the haotian-liu/llava repository at version 1.2.0, which is a significant concern as it affects the core file handling capabilities of the application. The flaw manifests when the system attempts to process file upload requests containing oversized filename parameters, leading to resource exhaustion and system unresponsiveness.
The technical root cause of this vulnerability aligns with CWE-400, which addresses "Uncontrolled Resource Consumption" or "Resource Exhaustion" in software systems. The improper handling of form-data with large filenames creates a scenario where the server's memory allocation and processing capabilities become overwhelmed during the file upload process. When an attacker submits a malicious payload with an extremely long filename, the application's internal processing mechanisms attempt to allocate memory proportional to the filename length, causing the system to consume excessive computational resources. This resource consumption pattern directly violates the principle of input validation and proper resource management as outlined in security best practices.
The operational impact of this vulnerability extends beyond simple service disruption, as it can be exploited by unauthorized parties without requiring authentication credentials. This unauthenticated nature significantly increases the attack surface and makes the vulnerability particularly dangerous in production environments where the application may be exposed to the public internet. The scalability of this exploit means that a single malicious request can potentially bring down the entire file upload service, affecting all legitimate users who rely on this functionality. The DoS condition manifests as complete service unavailability, forcing administrators to restart services and potentially causing extended downtime for users.
From a threat modeling perspective, this vulnerability maps directly to ATT&CK technique T1499.004, which covers "Endpoint Denial of Service" attacks. The attack vector leverages the application's file upload interface to consume system resources, effectively creating a resource exhaustion attack that prevents legitimate users from accessing the service. The lack of authentication requirements means that this attack can be executed by anyone with network access to the vulnerable system, making it particularly attractive to malicious actors seeking to disrupt services. Security teams should consider implementing rate limiting and input size validation as immediate protective measures against this specific threat.
The recommended mitigations for CVE-2024-12070 involve implementing comprehensive input validation mechanisms that enforce reasonable limits on filename length and file size parameters. Organizations should configure maximum file name length restrictions within the application's file upload handlers to prevent excessive resource allocation. Additionally, implementing proper resource monitoring and alerting systems can help detect unusual resource consumption patterns that may indicate exploitation attempts. The fix should also include proper error handling for oversized inputs, ensuring that the system gracefully rejects malformed requests rather than attempting to process them. Regular security updates and patch management procedures should be implemented to address similar vulnerabilities in third-party components and dependencies that may exist within the LLaVA framework.