CVE-2024-45412: medium-severity vulnerability in yeti-platform yeti
Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.8%
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks such as One Million Unicode payload. This can get worse with the use of special Unicode characters like U+2100 (℀), or U+2105 (℅) which could lead the payload size to be tripled. Versions prior to 2.1.11 are affected by this vulnerability. The patch is included in 2.1.11.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
yeti-platform · yetiRelated CVEs — yeti-platform yeti
In the same product, most dangerous first.
CVE-2026-92783HIGHYeti through 2.11.0 Missing Authorization on RBAC Relationship DeletionEPSS 0.5%CVE-2026-63482HIGHYeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence DataEPSS 0.4%CVE-2026-63502HIGHYeti: Path traversal in ExportTask name allows authenticated arbitrary file read and writeEPSS 0.4%CVE-2026-63500HIGHYeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive exportEPSS 0.4%CVE-2026-63489HIGHYeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parametersEPSS 0.3%