Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Realchar can be stopped by malformed file upload

CVE-2024-10051 · published 1 year ago
Summary

The Realchar application (version 0.0.4) can be taken offline by anyone sending a specially crafted file upload request. The malformed request makes the server work endlessly, consuming resources until it can no longer respond to legitimate users. Apply the vendor's patch or update to a fixed version to stop the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
shaunwei realchar 0.0.4
cpe:2.3:a:shaunwei:realchar:0.0.4:-:*:*:*:*:*:*
Original advisory text
Unauthenticated Denial of Service in shaunwei/realchar
Realchar version v0.0.4 is vulnerable to an unauthenticated denial of service (DoS) attack. The vulnerability exists in the file upload request handling, where appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request causes the server to continuously process each character. This leads to excessive resource consumption and renders the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published20 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-10051 · NVD
CVE-2024-10051 · OSV
Track software like this
Free during beta