CVE-2024-12761 Denial of Service in brycedrennan/imaginairy
An attacker can crash the Imaginairy server by sending an invalid request to the generate endpoint, causing service unavailability for all users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-12761?
CVE-2024-12761 is a high-severity denial of service vulnerability in brycedrennan/imaginairy, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Denial of Service (DoS) vulnerability exists in the brycedrennan/imaginairy repository, version 15.0.0. The vulnerability is present in the `/api/stablestudio/generate` endpoint, which can be exploited by sending an invalid request. This causes the server process to terminate abruptly, outputting `KILLED` in the terminal, and results in the unavailability of the server. This issue disrupts the server's functionality, affecting all users.
Weakness: CWE-400
Which versions are affected by CVE-2024-12761?
3 open source packages ship an affected version, including imaginairy and imaginAIry.
| Package | Affected | Fixed in |
|---|---|---|
imaginairy PyPI | All versions to 15.0.0 | None |
imaginairy PyPI | All versions to 15.0.0 | None |
imaginAIry PyPI | All versions to 15.0.0 | None |
How do I fix CVE-2024-12761?
No fix has been published for CVE-2024-12761 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-12761 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12761 exists.
Sources
Also known as GHSA-x5xw-28w4-53j5, PYSEC-2026-1458.