Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
High7.5CVE-2024-10624 · Published Mar 20, 2025 · updated Jul 7, 2026
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*
CVE-2024-10624: Gradio high vulnerability | Advisories
to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.
Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
High7.5CVE-2024-10624 · Published Mar 20, 2025 · updated Jul 7, 2026
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*
CVE-2024-10624: Gradio high vulnerability | Advisories
to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.
Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.
to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssVersion":"3.0","severitySource":"github","cwes":["CWE-1333","CWE-400"],"refs":["https://nvd.nist.gov/vuln/detail/CVE-2024-10624","https://github.com/gradio-app/gradio","https://github.com/gradio-app/gradio/blob/98cbcaef827de7267462ccba180c7b2ffb1e825d/gradio/components/datetime.py#L133-L136","https://huntr.com/bounties/e8d0b248-8feb-4c23-9ef9-be4d1e868374"],"affected":[{"product":"gradio","ecosystem":"PyPI","package":"gradio","introduced":"4.38.0","fixed":"","lastAffected":"5.0.0-beta.2"}],"changes":[]},"related":[{"id":"GHSA-5cpq-9538-jm2j","cve":"CVE-2024-8966","aliases":["CVE-2024-8966","PYSEC-2026-1410"],"summary":"Gradio DOS in multipart boundry while uploading the file","title":"Gradio DOS in multipart boundry while uploading the file","severity":"high","score":7.5,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"","fixFirst":"","fixedN":0,"published":"2025-03-20","modified":"2026-07-07","withdrawn":"","url":"https://github.com/advisories/GHSA-5cpq-9538-jm2j","foundAt":"2026-09-24 23:00:26"},{"id":"GHSA-7v2w-h4gh-w5cv","cve":"CVE-2024-8021","aliases":["CVE-2024-8021","PYSEC-2026-1411"],"summary":"Gradio Vulnerable to Open Redirect","title":"Gradio Vulnerable to Open Redirect","severity":"medium","score":5.4,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"","fixFirst":"","fixedN":0,"published":"2025-03-20","modified":"2026-07-07","withdrawn":"","url":"https://github.com/advisories/GHSA-7v2w-h4gh-w5cv","foundAt":"2026-09-24 23:00:26"},{"id":"GHSA-prpg-p95c-32fv","cve":"CVE-2024-12217","aliases":["CVE-2024-12217","PYSEC-2026-1418"],"summary":"Gradio Path Traversal vulnerability","title":"Gradio Path Traversal vulnerability","severity":"medium","score":5.3,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"","fixFirst":"","fixedN":0,"published":"2025-03-20","modified":"2026-07-07","withdrawn":"","url":"https://github.com/advisories/GHSA-prpg-p95c-32fv","foundAt":"2026-09-24 23:00:26"},{"id":"GHSA-7xmc-vhjp-qv5q","cve":"CVE-2024-10569","aliases":["CVE-2024-10569","PYSEC-2026-1412"],"summary":"Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb","title":"Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb","severity":"high","score":7.5,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"","fixFirst":"","fixedN":0,"published":"2025-03-20","modified":"2026-07-07","withdrawn":"","url":"https://github.com/advisories/GHSA-7xmc-vhjp-qv5q","foundAt":"2026-09-24 23:00:26"},{"id":"GHSA-pgfv-gvc5-prfg","cve":"CVE-2024-10648","aliases":["CVE-2024-10648","PYSEC-2026-1417"],"summary":"Gradio Vulnerable to Arbitrary File Deletion","title":"Gradio Vulnerable to Arbitrary File Deletion","severity":"high","score":8.2,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"","fixFirst":"","fixedN":0,"published":"2025-03-20","modified":"2026-07-07","withdrawn":"","url":"https://github.com/advisories/GHSA-pgfv-gvc5-prfg","foundAt":"2026-09-24 23:00:26"},{"id":"GHSA-j2jg-fq62-7c3h","cve":"CVE-2025-23042","aliases":["CVE-2025-23042","PYSEC-2025-118"],"summary":"Gradio Blocked Path ACL Bypass Vulnerability","title":"Gradio Blocked Path ACL Bypass Vulnerability","severity":"critical","score":null,"product":"gradio","productLabel":"","products":["gradio"],"fixed":"5.11.0","fixFirst":"5.11.0","fixedN":1,"published":"2025-01-14","modified":"2026-06-05","withdrawn":"","url":"https://github.com/advisories/GHSA-j2jg-fq62-7c3h","foundAt":"2026-09-24 23:00:26"}]}}
High7.5Mar 20, 2025