AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

BentoMLGHSA-hh3j-9m59-p8vc

BentoML vulnerable to Uncontrolled Resource Consumption

BentoML

Published Mar 20, 2025 · updated Apr 15, 2025

High7.5
No fix yet
GitHub advisory

In bentoml/bentoml version 1.3.9, the /login endpoint of the newly integrated Gradio app is vulnerable to a Denial of Service (DoS) attack. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction.

Affected versions

PackageAffectedFixed in
bentoml
PyPI
<= 1.3.9No fix yet
Details and references

More BentoML advisories

All BentoML