CVE-2024-8966: high-severity vulnerability in gradio-app/gradio
Denial of Service in gradio-app/gradio
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.8%
A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue warnings. This can render Gradio inaccessible for extended periods, disrupting services and causing significant downtime.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
gradio-app · gradio-app/gradioRelated CVEs — gradio-app/gradio
In the same product, most dangerous first.
CVE-2024-1728HIGHLocal File Inclusion in gradio-app/gradioEPSS 85.4%CVE-2024-4325HIGHServer-Side Request Forgery (SSRF) in gradio-app/gradioEPSS 37.1%CVE-2024-1561HIGHArbitrary Local File Read via Component Method Invocation in gradio-app/gradioEPSS 9.3%CVE-2024-1540HIGHCommand Injection in gradio-app/gradio via deploy+test-visual.yml workflowEPSS 2.0%CVE-2024-1183MEDIUMSSRF Vulnerability in gradio-app/gradioEPSS 1.8%CVE-2024-4253HIGHCommand Injection in gradio-app/gradioEPSS 1.7%