GitHub Advisoryadvisory · PyPI

GHSA-hh3j-9m59-p8vc BentoML vulnerable to Uncontrolled Resource Consumption

HIGH Published 2025-03-20 Modified 2025-04-15 Official page ↗
Ecosystem
PyPI
Packages
bentoml
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2025-03-21

Affected packages

• PyPI bentoml: <= 1.3.9 (no fix yet)

Description

In bentoml/bentoml version 1.3.9, the `/login` endpoint of the newly integrated Gradio app is vulnerable to a Denial of Service (DoS) attack. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References