{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mistral.rs/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mistral.rs"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","resource-exhaustion"],"_cs_type":"advisory","_cs_vendors":["EricLBuehler"],"content_html":"\u003cp\u003eThe mistral.rs OpenAI-compatible HTTP server contains multiple critical vulnerabilities in its media handling logic that lead to denial of service (DoS). Specifically, the \u003ccode\u003e/v1/chat/completions\u003c/code\u003e endpoint allows unauthenticated users to provide arbitrary remote URLs for images, audio, or video. The server-side code uses \u003ccode\u003ereqwest::get().bytes().await?.to_vec()\u003c/code\u003e to fetch these resources without enforcing any byte limits, content-length validation, or fetch timeouts. An attacker can supply a URL pointing to an infinite HTTP stream or a malicious payload, causing the server process to buffer data until it exhausts all available system memory, leading to an OOM kill. Furthermore, the video processing component utilizes FFmpeg to extract frames. When the \u003ccode\u003enum_frames\u003c/code\u003e parameter is set to \u003ccode\u003eNone\u003c/code\u003e (which occurs by default in the chat completion logic), FFmpeg extracts every frame of a video to the local disk. By providing a high-framerate, long-duration video, an attacker can rapidly consume all available disk space and saturate CPU resources.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target server running an unauthenticated mistral.rs instance.\u003c/li\u003e\n\u003cli\u003eAttacker prepares an HTTP server controlled by them to host malicious media content.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a JSON payload for the \u003ccode\u003e/v1/chat/completions\u003c/code\u003e endpoint containing a remote URL pointing to their malicious host.\u003c/li\u003e\n\u003cli\u003eThe mistral.rs server receives the request and initializes an asynchronous fetch of the attacker-supplied URL.\u003c/li\u003e\n\u003cli\u003eThe server buffer logic consumes incoming bytes indefinitely due to the absence of byte limits.\u003c/li\u003e\n\u003cli\u003eMemory utilization of the mistral.rs process spikes continuously until the Linux kernel invokes the OOM killer (exit code 137).\u003c/li\u003e\n\u003cli\u003eIn the video scenario, the server invokes FFmpeg, which begins writing thousands of extracted PNG frames to \u003ccode\u003e/tmp/mistralrs_video/\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFinal objective is achieved: the server process is killed or the disk partition is fully saturated, rendering the service unavailable.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability affects any deployment of mistral.rs that exposes the \u003ccode\u003e/v1/chat/completions\u003c/code\u003e endpoint to the network. Because the endpoint lacks authentication by default, the barrier to exploitation is minimal. Successful exploitation results in complete service unavailability, necessitating a manual restart of the server process. Impact includes forced downtime for AI-powered services relying on this backend, potential disk write amplification, and resource exhaustion of the host environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize restricting network access to the mistral.rs management and chat completion ports if they are exposed to untrusted environments. Implement a Web Application Firewall (WAF) or proxy layer to validate and filter incoming JSON request schemas, specifically monitoring for \u003ccode\u003eimage_url\u003c/code\u003e and \u003ccode\u003evideo_url\u003c/code\u003e parameters. Audit the server environment for the existence of large files in \u003ccode\u003e/tmp/mistralrs_video/\u003c/code\u003e which may indicate exploitation attempts. Detection engineering teams should implement monitoring for unexpected OOM killer events (exit code 137) associated with the mistral.rs process.\u003c/p\u003e\n","date_modified":"2026-09-11T00:54:32Z","date_published":"2026-09-11T00:54:32Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mistral-rs-dos/","summary":"The mistral.rs /v1/chat/completions endpoint suffers from unbounded resource consumption vulnerabilities, allowing unauthenticated remote attackers to trigger OOM kills, disk exhaustion, or CPU saturation.","title":"Unbounded Remote Media Fetch and Video Frame Expansion DoS in mistral.rs","url":"https://feed.craftedsignal.io/briefs/2026-09-mistral-rs-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Mistral.rs","version":"https://jsonfeed.org/version/1.1"}