GitHub Advisoryadvisory · PyPI

GHSA-rvgh-pr46-x7gg Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

HIGH Published 2025-03-20 Modified 2025-03-20 Official page ↗
Aliases
CVE-2024-10624
Ecosystem
PyPI
Packages
gradio
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333, CWE-400
Reviewed
2025-03-20

Affected packages

• PyPI gradio: >= 4.38.0, <= 5.0.0-beta.2 (no fix yet)

Description

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$` to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.

Related

Alias · CVE (1)

  • CVE-2024-10624 A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime… vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References