GradioGHSA-7xmc-vhjp-qv5q
Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb
High7.5CVE-2024-10569 · Published Mar 20, 2025 · updated Jul 7, 2026
A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server crash and causing a denial of service.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| gradio PyPI | >= 4.0.0, <= 5.0.0b2 | No fix yet |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-475
- Also known as
- CVE-2024-10569, PYSEC-2026-1412
More Gradio advisories
All Gradio| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | Gradio DOS in multipart boundry while uploading the file High7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | Gradio Vulnerable to Open RedirectMedium5.4Mar 20, 2025 | Medium5.4 | No fix yet |
| Mar 202025 | Gradio Path Traversal vulnerabilityMedium5.3Mar 20, 2025 | Medium5.3 | No fix yet |
| Mar 202025 | Gradio Vulnerable to Arbitrary File DeletionHigh8.2Mar 20, 2025 | High8.2 | No fix yet |
| Mar 202025 | Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP RequestHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Jan 142025 | Gradio Blocked Path ACL Bypass VulnerabilityCriticalJan 14, 2025 | Critical | 5.11.0 |