CVE-2025-0182: Denial of Service in danswer-ai/danswer
A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion. The issue arises from the use of a vulnerable version of the starlette package (<=0.49) via fastapi, which was patched in fastapi version 0.115.3. The vulnerability can be exploited by sending multiple requests to the /auth/saml/callback endpoint, leading to uncontrolled memory consumption and eventual denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0182?
CVE-2025-0182 is classified as a denial of service vulnerability due to memory exhaustion.
How do I fix CVE-2025-0182?
To mitigate CVE-2025-0182, upgrade fastapi to version 0.115.3 or higher, which resolves the issue.
Which packages are affected by CVE-2025-0182?
CVE-2025-0182 affects the danswer-ai/danswer package and the starlette package versions 0.49 and below.
What is the cause of the CVE-2025-0182 vulnerability?
The vulnerability is caused by a memory exhaustion issue stemming from the use of a vulnerable version of the starlette package.
Can CVE-2025-0182 impact production systems?
Yes, CVE-2025-0182 can impact production systems by causing denial of service through resource exhaustion.