CVE-2024-10624highCWE-1333

CVE-2024-10624: high-severity vulnerability in gradio-app/gradio

Regular Expression Denial of Service (ReDoS) in gradio-app/gradio

Published · Updated

Follow this CVE+ Monitor gradio-app/gradio+ Monitor gradio

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.1%
In short

A weakness in the gr.Datetime component of Gradio allows attackers to send specially crafted inputs that make the server spend excessive CPU time processing a regular expression, freezing the application and denying service to legitimate users.

Technical detail

A ReDoS vulnerability in the gr.Datetime component's regex pattern `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$` permits unauthenticated remote attackers to trigger polynomial-time regex matching via crafted HTTP requests, exhausting CPU resources and causing denial of service.

Summary generated and translated by AI from the official description.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$` to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
gradio-app · gradio-app/gradio
Related CVEs — gradio-app/gradio

In the same product, most dangerous first.

CVE-2024-1728HIGHLocal File Inclusion in gradio-app/gradioEPSS 85.4%CVE-2024-4325HIGHServer-Side Request Forgery (SSRF) in gradio-app/gradioEPSS 37.1%CVE-2024-1561HIGHArbitrary Local File Read via Component Method Invocation in gradio-app/gradioEPSS 9.3%CVE-2024-1540HIGHCommand Injection in gradio-app/gradio via deploy+test-visual.yml workflowEPSS 2.0%CVE-2024-1183MEDIUMSSRF Vulnerability in gradio-app/gradioEPSS 1.8%CVE-2024-4253HIGHCommand Injection in gradio-app/gradioEPSS 1.7%