AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

GradioGHSA-rvgh-pr46-x7gg

Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

Gradio

CVE-2024-10624 · Published Mar 20, 2025 · updated Jul 7, 2026

High7.5
No fix yet
GitHub advisory

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression ^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$ to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.

Affected versions

PackageAffectedFixed in
gradio
PyPI
>= 4.38.0, <= 5.0.0-beta.2No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-1333, CWE-400
Also known as
CVE-2024-10624, PYSEC-2026-1421

More Gradio advisories

All Gradio
High 7.5Mar 20, 2025Gradio DOS in multipart boundry while uploading the fileCVE-2024-8966no fix yetMedium 5.4Mar 20, 2025Gradio Vulnerable to Open RedirectCVE-2024-8021no fix yetMedium 5.3Mar 20, 2025Gradio Path Traversal vulnerabilityCVE-2024-12217no fix yetHigh 7.5Mar 20, 2025Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip BombCVE-2024-10569no fix yetHigh 8.2Mar 20, 2025Gradio Vulnerable to Arbitrary File DeletionCVE-2024-10648no fix yetCriticalJan 14, 2025Gradio Blocked Path ACL Bypass VulnerabilityCVE-2025-23042fixed in 5.11.0
CVE-2024-10624: Gradio high vulnerability | Advisories

AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

GradioGHSA-rvgh-pr46-x7gg

Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

Gradio

CVE-2024-10624 · Published Mar 20, 2025 · updated Jul 7, 2026

High7.5
No fix yet
GitHub advisory

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression ^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$ to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.

Affected versions

PackageAffectedFixed in
gradio
PyPI
>= 4.38.0, <= 5.0.0-beta.2No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-1333, CWE-400
Also known as
CVE-2024-10624, PYSEC-2026-1421

More Gradio advisories

All Gradio
High 7.5Mar 20, 2025Gradio DOS in multipart boundry while uploading the fileCVE-2024-8966no fix yetMedium 5.4Mar 20, 2025Gradio Vulnerable to Open RedirectCVE-2024-8021no fix yetMedium 5.3Mar 20, 2025Gradio Path Traversal vulnerabilityCVE-2024-12217no fix yetHigh 7.5Mar 20, 2025Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip BombCVE-2024-10569no fix yetHigh 8.2Mar 20, 2025Gradio Vulnerable to Arbitrary File DeletionCVE-2024-10648no fix yetCriticalJan 14, 2025Gradio Blocked Path ACL Bypass VulnerabilityCVE-2025-23042fixed in 5.11.0
to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssVersion":"3.0","severitySource":"github","cwes":["CWE-1333","CWE-400"],"refs":["https://nvd.nist.gov/vuln/detail/CVE-2024-10624","https://github.com/gradio-app/gradio","https://github.com/gradio-app/gradio/blob/98cbcaef827de7267462ccba180c7b2ffb1e825d/gradio/components/datetime.py#L133-L136","https://huntr.com/bounties/e8d0b248-8feb-4c23-9ef9-be4d1e868374"],"affected":[{"product":"gradio","ecosystem":"PyPI","package":"gradio","introduced":"4.38.0","fixed":"","lastAffected":"5.0.0-beta.2"}],"changes":[]},"related":[{"id":"GHSA-5cpq-9538-jm2j","cve":"CVE-2024-8966","aliases":["CVE-2024-8966","PYSEC-2026-1410"],"summary":"Gradio DOS in multipart boundry while uploading the file","title":"Gradio DOS in multipart boundry while uploading the file","severity":"high","score":7.5,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"","fixFirst":"","fixedN":0,"published":"2025-03-20","modified":"2026-07-07","withdrawn":"","url":"https://github.com/advisories/GHSA-5cpq-9538-jm2j","foundAt":"2026-09-24 23:00:26"},{"id":"GHSA-7v2w-h4gh-w5cv","cve":"CVE-2024-8021","aliases":["CVE-2024-8021","PYSEC-2026-1411"],"summary":"Gradio Vulnerable to Open Redirect","title":"Gradio Vulnerable to Open Redirect","severity":"medium","score":5.4,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"","fixFirst":"","fixedN":0,"published":"2025-03-20","modified":"2026-07-07","withdrawn":"","url":"https://github.com/advisories/GHSA-7v2w-h4gh-w5cv","foundAt":"2026-09-24 23:00:26"},{"id":"GHSA-prpg-p95c-32fv","cve":"CVE-2024-12217","aliases":["CVE-2024-12217","PYSEC-2026-1418"],"summary":"Gradio Path Traversal vulnerability","title":"Gradio Path Traversal vulnerability","severity":"medium","score":5.3,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"","fixFirst":"","fixedN":0,"published":"2025-03-20","modified":"2026-07-07","withdrawn":"","url":"https://github.com/advisories/GHSA-prpg-p95c-32fv","foundAt":"2026-09-24 23:00:26"},{"id":"GHSA-7xmc-vhjp-qv5q","cve":"CVE-2024-10569","aliases":["CVE-2024-10569","PYSEC-2026-1412"],"summary":"Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb","title":"Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb","severity":"high","score":7.5,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"","fixFirst":"","fixedN":0,"published":"2025-03-20","modified":"2026-07-07","withdrawn":"","url":"https://github.com/advisories/GHSA-7xmc-vhjp-qv5q","foundAt":"2026-09-24 23:00:26"},{"id":"GHSA-pgfv-gvc5-prfg","cve":"CVE-2024-10648","aliases":["CVE-2024-10648","PYSEC-2026-1417"],"summary":"Gradio Vulnerable to Arbitrary File Deletion","title":"Gradio Vulnerable to Arbitrary File Deletion","severity":"high","score":8.2,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"","fixFirst":"","fixedN":0,"published":"2025-03-20","modified":"2026-07-07","withdrawn":"","url":"https://github.com/advisories/GHSA-pgfv-gvc5-prfg","foundAt":"2026-09-24 23:00:26"},{"id":"GHSA-j2jg-fq62-7c3h","cve":"CVE-2025-23042","aliases":["CVE-2025-23042","PYSEC-2025-118"],"summary":"Gradio Blocked Path ACL Bypass Vulnerability","title":"Gradio Blocked Path ACL Bypass Vulnerability","severity":"critical","score":null,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"5.11.0","fixFirst":"5.11.0","fixedN":1,"published":"2025-01-14","modified":"2026-06-05","withdrawn":"","url":"https://github.com/advisories/GHSA-j2jg-fq62-7c3h","foundAt":"2026-09-24 23:00:26"}]}}