OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint
Impact
OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. This could be used to effectively run a denial of service attack on the OctoPrint server.
Patches
The vulnerability has been patched in version 1.11.2.
Workaround
OctoPrint administrators are once more reminded to not make OctoPrint available on hostile networks (e.g. the internet), regardless of whether this vulnerability is patched or not.
Details
The issue can be triggered by a broken multipart/form-data request lacking an end boundary to any of OctoPrint's endpoints implemented through the octoprint.server.util.tornado.UploadStorageFallbackHandler request handler. The request handler will get stuck in an endless busy loop, looking for a part of the request that will never come. As Tornado is single-threaded, that will effectively block the whole web server.
The fix adds detection of invalid requests like that and ensures they are handled gracefully with an HTTP 400 Bad Request response.
Credits
This vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | octoprint | < 1.11.2 | 1.11.2 |
Referencias
- https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-9wj4-8h85-pgrw
- https://nvd.nist.gov/vuln/detail/CVE-2025-48879
- https://github.com/OctoPrint/OctoPrint/commit/c9c35c17bd820f19c6b12e6c0359fc0cfdd0c1ec
- https://github.com/OctoPrint/OctoPrint
- https://pypi.org/project/octoprint
- https://github.com/advisories/GHSA-9wj4-8h85-pgrw
- Vector CVSS
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Debilidad (CWE)
CWE-140, CWE-835- Plataforma
- Python (PyPI)
- Paquete
octoprint- Publicada
- 10.06.2025
- Actualizado
- 11.10.2026 13:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-1713 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-9wj4-8h85-pgrw - CC BY 4.0
Historial de vulnerabilidades: octoprint
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 24
- Primera → última
- 05.2021 06.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 8
- Media 13
- Baja 2
Divulgaciones por año
- 2021: 2
- 2022: 8
- 2023: 1
- 2024: 5
- 2025: 5
- 2026: 3
-
OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.