PT-2025-12254 · Unknown+1 · @Gradio/Video+1

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8966

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions gradio-app/gradio version @gradio/video@0.10.2

Description A Denial of Service (DoS) attack is possible due to a vulnerability in the file upload process. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue warnings. This can render Gradio inaccessible for extended periods, disrupting services and causing significant downtime.

Recommendations For version @gradio/video@0.10.2, consider restricting the size of file uploads or the number of characters allowed in multipart boundaries to prevent excessive processing and warnings. As a temporary workaround, consider implementing rate limiting or input validation to minimize the risk of exploitation.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2024-8966

GHSA-5CPQ-9538-JM2J

GHSA-HH3J-9M59-P8VC

Affected Products

Gradio

@Gradio/Video

References · 11

• 🔥 https://huntr.com/bounties/7b5932bb-58d1-4e71-b85c-43dc40522ff2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12759 · Security Note
• https://osv.dev/vulnerability/GHSA-5cpq-9538-jm2j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8966 · Security Note
• https://osv.dev/vulnerability/GHSA-hh3j-9m59-p8vc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8966 · Vendor Advisory
• https://github.com/gradio-app/gradio · Note
• https://github.com/gradio-app/gradio/commit/f1718c47137f9c60240da7afe5e3290aa0f1cb47 · Note
• https://github.com/bentoml/BentoML · Note
• https://huntr.com/bounties/e467ec92-0ad1-4461-8468-1beabf701b9f · Note
• https://twitter.com/CVEnew/status/1902671032986505515 · Twitter Post