---
id: CVE-2024-10821
aliases:
  - GHSA-6f6x-f56q-5xgv
  - PYSEC-2026-1466
title: InvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`
summary: InvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: invokeai
product: invokeai
ecosystem: pip
affected:
  - invokeai <= 5.0.2
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6f6x-f56q-5xgv'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-10821'
  - url: 'https://github.com/invoke-ai/InvokeAI'
  - url: >-
      https://github.com/invoke-ai/InvokeAI/blob/807f458f13e7693ada2fb929c2d513950611fe9c/invokeai/app/api/routers/images.py#L29
  - url: 'https://huntr.com/bounties/0ac24835-c4c0-4f11-938a-d5641dfb80b2'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00629
epssPercentile: 0.47928
ingestedAt: '2026-07-08T18:25:46.329Z'
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/dannyEndorTest/invokeai'
    - 'https://github.com/dannyEndorTest/invokeai-consumer'
  checkedAt: '2026-09-26T09:05:32.256Z'
exploitAvailable: true
---

## Overview

A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and a complete denial of service for all users. The affected endpoint is `/api/v1/images/upload`.

## Affected packages

- `invokeai <= 5.0.2`

## Remediation

Refer to the advisory for the patched release.