Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-9056Denial of Service in bentoml/bentoml
High 7.5
In plain English
A high-severity resource allocation without limits in bentoml/bentoml from bentoml. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. This causes the server to continuously process each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | bentoml | no fix listed | GHSA-hw8j-hw49-752c |
| PyPI | bentoml | no fix listed | PYSEC-2026-1219 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bentoml | bentoml/bentoml | unspecified – through latest |
Weakness: CWE-770 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H