CVE-2024-9340CWE-835

Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml

High · published March 20, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
61.5
In the wild
Unconfirmed
What it is

A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00970 · 61.5th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2025-03-20T10:08Z
EPSS history
Timeline
  • 20 MAR 10:08Z
    Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml
    cvelistv5