Danswer Denial-of-Service Vulnerability via Malformed Multipart Boundary

A denial-of-service vulnerability has been identified in danswer-ai/danswer version 0.3.94. The issue arises when an attacker uploads a file with a malformed multipart boundary, specifically by adding an excessive number of characters to the end of the boundary. This causes the server to continuously process each character, leading to application unavailability. The vulnerability can be exploited by sending a single crafted request, impacting all users on the server.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, making the application inaccessible to users.