CVE-2024-11043 Denial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeai
Attackers can cause denial of service by sending large payloads to the board name field, making the UI unresponsive and preventing board management.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-11043?
CVE-2024-11043 is a high-severity denial of service vulnerability in invoke-ai/invokeai, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Denial of Service (DoS) vulnerability was discovered in the /api/v1/boards/{board_id} endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occurs when an excessively large payload is sent in the board_name field during a PATCH request. By sending a large payload, the UI becomes unresponsive, rendering it impossible for users to interact with or manage the affected board. Additionally, the option to delete the board becomes inaccessible, amplifying the severity of the issue.
Weakness: CWE-400
Which versions are affected by CVE-2024-11043?
3 open source packages ship an affected version, including invokeai and InvokeAI.
| Package | Affected | Fixed in |
|---|---|---|
invokeai PyPI | All versions to 5.0.2 | None |
invokeai PyPI | All versions to 5.0.2 | None |
InvokeAI PyPI | All versions to 5.0.2 | None |
How do I fix CVE-2024-11043?
No fix has been published for CVE-2024-11043 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-11043 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11043 exists.
Sources
Also known as GHSA-ffh5-w482-c7m5, PYSEC-2026-1467.