ZenML unauthenticated DoS via Multipart Boundry
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-9340US | — | — | ||
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart req… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2025-57.yamlWEB
- https://github.com/zenml-io/zenmlPACKAGE
- https://github.com/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48dWEB
- https://huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-9340ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan