Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-9340Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml
High 7.5
In plain English
A high-severity infinite loop in zenml-io/zenml from zenml-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | zenml | 0.68.0 | GHSA-6gmf-2369-c76c |
| PyPI | zenml | 0.68.0 | PYSEC-2025-57 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zenml-io | zenml-io/zenml | unspecified – before 0.68.0 |
Weakness: CWE-835 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H