GHSA-5cpq-9538-jm2j

Gradio DOS in multipart boundry while uploading the file

Source: GitHub Advisory Database (reviewed) High CVE-2024-8966

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	gradio	<= 5.22.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability in the file upload process of gradio-app/gradio version @gradio/[email protected] allows for a Denial of Service (DoS) attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue warnings. This can render Gradio inaccessible for extended periods, disrupting services and causing significant downtime.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-8966 advisory
https://github.com/gradio-app/gradio/commit/f1718c47137f9c60240da7afe5e3290aa0f1cb47 web
https://github.com/gradio-app/gradio package
https://huntr.com/bounties/7b5932bb-58d1-4e71-b85c-43dc40522ff2 web