CVE-2024-9340: Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include /api/v1/login and /api/v1/deviceauthorization.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9340?
CVE-2024-9340 is classified as a Denial of Service (DoS) vulnerability.
How do I fix CVE-2024-9340?
To mitigate CVE-2024-9340, upgrade to zenml version 0.68.0 or later.
What causes CVE-2024-9340?
CVE-2024-9340 is caused by the processing of malformed multipart requests leading to excessive resource consumption.
Is CVE-2024-9340 exploitable by authenticated users?
No, CVE-2024-9340 can be exploited by unauthenticated attackers.
Which software versions are affected by CVE-2024-9340?
CVE-2024-9340 affects zenml-io/zenml version 0.66.0.