CVE-2024-10713: HyperLPR v3.0 Denial of Service Vulnerability

CVE-2024-10713 Overview

CVE-2024-10713 is a denial of service (DoS) vulnerability in szad670401/hyperlpr v3.0, an open-source license plate recognition project. The server fails to properly handle excessive characters appended to multipart boundary delimiters. Attackers can send malformed multipart requests containing arbitrary characters at the end of the boundary, causing excessive resource consumption. Exploitation requires no authentication or user interaction. Successful attacks render the service unavailable to all legitimate users. The flaw is categorized under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Unauthenticated remote attackers can trigger complete service unavailability by sending crafted multipart HTTP requests with malformed boundary delimiters.

Affected Products

szad670401/hyperlpr v3.0
Deployments exposing the hyperlpr HTTP server
Downstream services and containers embedding hyperlpr v3.0

Discovery Timeline

2025-03-20 - CVE-2024-10713 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10713

Vulnerability Analysis

The vulnerability resides in the hyperlpr HTTP server's parsing of multipart/form-data requests. When a client submits a multipart request, the boundary parameter declared in the Content-Type header separates individual parts of the payload. The server does not validate or bound the trailing characters attached to that boundary. An attacker appends arbitrary bytes after the boundary token, and the parser continues processing without applying resource limits. This uncontrolled parsing loop consumes CPU and memory until the process becomes unresponsive.

Because the request path does not require authentication, any client that can reach the exposed endpoint can trigger the condition. A single low-bandwidth request is sufficient to affect all concurrent users. The impact profile is availability-only — no confidentiality or integrity loss occurs. The weakness maps to CWE-770, reflecting missing throttling on multipart parsing.

Root Cause

The root cause is missing input validation on multipart boundary delimiters. The parser accepts and processes unbounded trailing content instead of rejecting non-conforming boundary strings per RFC 2046. Without a maximum length check or a strict boundary termination rule, the server allocates resources proportional to attacker-controlled input.

Attack Vector

Exploitation occurs over the network. An attacker sends an HTTP POST request with Content-Type: multipart/form-data; boundary=<token><arbitrary_padding> to the hyperlpr recognition endpoint. Repeated or sustained requests keep the service in a resource-exhausted state. Refer to the Huntr Bug Bounty Listing for the disclosure record.

Detection Methods for CVE-2024-10713

Indicators of Compromise

HTTP POST requests to hyperlpr endpoints with abnormally long boundary parameters in the Content-Type header
Sudden CPU or memory spikes on hosts running hyperlpr v3.0 with no correlating legitimate workload
Increased request timeouts and 502/504 responses from services fronting hyperlpr
Multiple malformed multipart requests originating from a single source IP in a short window

Detection Strategies

Inspect Content-Type headers at the reverse proxy or WAF and flag boundary tokens exceeding 70 characters, the RFC 2046 limit
Correlate application-level resource exhaustion with recent multipart request patterns using centralized logging
Baseline normal request size and parsing latency for the hyperlpr endpoint and alert on deviations

Monitoring Recommendations

Monitor process-level CPU, memory, and thread counts for the hyperlpr service and alert on sustained saturation
Log full Content-Type header values at the ingress layer for retrospective analysis
Track HTTP request rates per source IP and enforce rate limits on the recognition endpoint

How to Mitigate CVE-2024-10713

Immediate Actions Required

Restrict network access to hyperlpr endpoints so only trusted clients on internal networks can reach the service
Place a reverse proxy or WAF in front of hyperlpr and enforce strict validation of multipart boundary length
Apply per-client request rate limiting to prevent sustained resource exhaustion
Monitor the upstream project for a patched release and track vendor communications for a fixed version

Patch Information

No official vendor patch is referenced in the NVD entry at the time of writing. Track the Huntr Bug Bounty Listing and the upstream szad670401/hyperlpr repository for a remediated release. Until a fix is available, apply the workarounds below.

Workarounds

Deploy an ingress filter that rejects Content-Type headers where the boundary parameter exceeds 70 characters per RFC 2046
Terminate multipart parsing at the proxy layer with strict size and timeout limits before requests reach hyperlpr
Run hyperlpr behind cgroup or container resource limits to contain the blast radius of a successful DoS
Disable public exposure of the recognition endpoint and require authenticated access through an API gateway

bash

# Example NGINX configuration to bound multipart boundary length and request size
http {
    client_max_body_size 10m;
    client_body_timeout 10s;

    map $http_content_type $bad_boundary {
        default 0;
        "~*boundary=[^;]{71,}" 1;
    }

    server {
        listen 80;
        location /recognition {
            if ($bad_boundary) { return 400; }
            limit_req zone=hyperlpr burst=5 nodelay;
            proxy_pass http://hyperlpr_backend;
        }
    }
}