CVE-2025-48879

OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. The issue can be triggered by a broken multipart/form-data request lacking an end boundary to any of OctoPrint's endpoints implemented through the octoprint.server.util.tornado.UploadStorageFallbackHandler request handler. The request handler will get stuck in an endless busy loop, looking for a part of the request that will never come. As Tornado is single-threaded, that will effectively block the whole web server. The vulnerability has been patched in version 1.11.2.

• CWE-140
• CWE-835

• https://github.com/OctoPrint/OctoPrint/commit/c9c35c17bd820f19c6b12e6c0359fc0cfdd0c1ecPatch
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-9wj4-8h85-pgrwMitigation, Vendor Advisory

Published

Jun 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48873Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-48874Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-48875FreeScout is a free self-hosted help desk and shared mailbox…5.4
• CVE-2025-48876Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2025-48877Discourse is an open-source discussion platform. Prior to ve…9.8
• CVE-2025-48878Combodo iTop is a web based IT service management tool. In v…4.3
• CVE-2025-4888A vulnerability, which was classified as critical, was found…7.8
• CVE-2025-48880FreeScout is a free self-hosted help desk and shared mailbox…6.6
• CVE-2025-48881Valtimo is a platform for Business Process Automation. In ve…8.3
• CVE-2025-48882PHPOffice Math is a library that provides a set of classes t…8.7
• CVE-2025-48883Chrome PHP allows users to start playing with chrome/chromiu…5.3
• CVE-2025-48884Galette is a membership management web application for non p…6.1