CVE-2024-12761: Imaginairy API DoS Vulnerability

CVE-2024-12761 Overview

CVE-2024-12761 is a Denial of Service (DoS) vulnerability in the brycedrennan/imaginairy repository, version 15.0.0. The flaw resides in the /api/stablestudio/generate endpoint. An unauthenticated attacker can send a malformed request to the endpoint, causing the server process to terminate abruptly with a KILLED message in the terminal. The condition maps to [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
A single invalid HTTP request to /api/stablestudio/generate terminates the server process, resulting in full service unavailability for every user of the imaginairy instance.

Affected Products

brycedrennan/imaginairy version 15.0.0
Deployments exposing the /api/stablestudio/generate endpoint
Downstream applications embedding the affected imaginairy release

Discovery Timeline

2025-03-20 - CVE-2024-12761 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12761

Vulnerability Analysis

The vulnerability affects the imaginairy AI image generation server, specifically the Stable Studio compatible API surface. When the /api/stablestudio/generate endpoint receives an invalid request payload, the server does not validate or reject the input safely. Instead, the underlying process consumes resources until the operating system kills it, producing a KILLED message on the console. Because imaginairy runs the generation pipeline in the same process as the HTTP server, termination brings down the entire service. The issue is categorized under [CWE-400] Uncontrolled Resource Consumption and is remotely triggerable without authentication.

Root Cause

The root cause is missing input validation on the request handler backing /api/stablestudio/generate. Malformed input propagates into the image generation pipeline, where memory or GPU allocation grows unchecked until the process is terminated by the kernel out-of-memory killer. No resource limits, request size checks, or exception boundaries protect the worker.

Attack Vector

Exploitation requires only network reachability to the imaginairy HTTP interface. The attacker sends a crafted invalid request to /api/stablestudio/generate using any HTTP client. No credentials, user interaction, or elevated privileges are required. The Exploit Prediction Scoring System (EPSS) probability is 0.664% (percentile 47.291) as of 2026-07-07.

A public technical writeup describing the reproduction steps is available in the Huntr Bug Bounty Report.

Detection Methods for CVE-2024-12761

Indicators of Compromise

Server console output containing the string KILLED immediately after an HTTP request to /api/stablestudio/generate.
Unexpected process termination of the imaginairy Python worker followed by service unavailability.
Linux kernel log entries (dmesg, /var/log/syslog) referencing the OOM killer terminating the imaginairy process.

Detection Strategies

Monitor HTTP access logs for requests to /api/stablestudio/generate that are followed by connection resets or 502/503 responses from the reverse proxy.
Alert on repeated process restarts of the imaginairy service through systemd, Docker, or Kubernetes restart counters.
Correlate malformed JSON payloads to the generate endpoint with kernel-level OOM events on the host.

Monitoring Recommendations

Track memory and GPU utilization of the imaginairy process and alert on sudden allocation spikes tied to inbound requests.
Enable rate limiting and request-body validation logging at the reverse proxy in front of imaginairy.
Aggregate application, kernel, and container runtime logs into a central store to identify DoS attempts across replicas.

How to Mitigate CVE-2024-12761

Immediate Actions Required

Restrict network exposure of the /api/stablestudio/generate endpoint to trusted clients using firewall rules, VPN, or authenticated reverse proxy access.
Deploy a reverse proxy in front of imaginairy that enforces strict JSON schema validation and rejects malformed requests before they reach the application.
Configure a process supervisor (systemd, Docker restart: always, or Kubernetes liveness probes) to automatically restart the worker after termination.

Patch Information

At the time of the last NVD update on 2026-06-17, no vendor patch is referenced in the CVE record. Consult the Huntr Bug Bounty Report and the upstream brycedrennan/imaginairy repository for updated releases beyond version 15.0.0 before deploying to production.

Workarounds

Place the imaginairy service behind an authenticated gateway to block anonymous requests to the vulnerable endpoint.
Apply per-client rate limits and request-body size caps at the ingress layer to reduce the attack surface.
Run imaginairy inside a container with strict memory and CPU limits, and pair it with an auto-restart policy so a killed process resumes service quickly.
Temporarily disable or route away traffic from /api/stablestudio/generate if the endpoint is not required by the deployment.

bash

# Configuration example: nginx location block enforcing size limits and rate limiting
limit_req_zone $binary_remote_addr zone=imaginairy:10m rate=5r/m;

server {
    listen 443 ssl;
    server_name imaginairy.example.com;

    location /api/stablestudio/generate {
        limit_req zone=imaginairy burst=2 nodelay;
        client_max_body_size 1m;
        proxy_read_timeout 30s;
        auth_basic "imaginairy";
        auth_basic_user_file /etc/nginx/.htpasswd;
        proxy_pass http://127.0.0.1:8000;
    }
}