AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ZenMLGHSA-6gmf-2369-c76c

ZenML unauthenticated DoS via Multipart Boundry

ZenML

CVE-2024-9340 · Published Mar 20, 2025 · updated Jun 30, 2025

High7.5
Fix: upgrade to 0.68.0 or later
GitHub advisory

A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include /api/v1/login and /api/v1/device_authorization.

Affected versions

PackageAffectedFixed in
zenml
PyPI
< 0.68.00.68.0
Details and references

More ZenML advisories

All ZenML