Youdao Qanything Denial-of-Service Vulnerability in File Upload Feature

A denial-of-service vulnerability has been identified in the file upload feature of Youdao Qanything version 2.0.0. This vulnerability arises from improper handling of form-data containing large filenames in upload requests. An attacker can exploit this issue by sending a filename that is excessively large, which can overwhelm the server and render it unavailable to legitimate users. The attack does not require authentication, increasing its scalability and risk of exploitation.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the server to become unresponsive and unavailable for legitimate users.