PT-2025-12263 · Bentoml · Bentoml

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-9056

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BentoML version v1.3.4post1

Description The issue is a Denial of Service (DoS) attack that can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. This causes the server to continuously process each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.

Recommendations For BentoML version v1.3.4post1, consider restricting access to the HTTP request processing module to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using multipart boundaries in HTTP requests that may be vulnerable to this issue.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2024-9056

GHSA-HW8J-HW49-752C

Affected Products

Bentoml

References · 7

• https://osv.dev/vulnerability/GHSA-hw8j-hw49-752c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9056 · Security Note
• https://github.com/bentoml/BentoML · Note
• https://github.com/bentoml/BentoML/blob/v1.4.5/src/bentoml/_internal/io_descriptors/file.py#L293C9-L293C66 · Note
• https://github.com/bentoml/BentoML/blob/a6f5f937be6ec278f3d4f3bbc6f3c8f9564820d7/src/bentoml/_internal/io_descriptors/file.py#L293 · Note
• https://twitter.com/CVEnew/status/1902671147881156635 · Twitter Post
• https://huntr.com/bounties/a24a13c2-0300-4a95-b26a-ac7fe8f6521b · Note