CVE-2024-9340 HIGH

CVE-2024-9340: Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml

Vendor Zenml-Io
Product zenml-io/zenml
Weakness CWE-835
Published March 20, 2025
Last update July 15, 2025

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
July 15, 2025 Record updated