CVE-2024-9340 json
Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml
published 2025-03-20 19 mo ago modified 2026-06-17 4 mo ago also GHSA-6gmf-2369-c76c , PYSEC-2025-57 , EUVD-2025-6854
- cvss
- 7.5
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | zenml | <0.68.0 |
0.68.0 |
Affected products
- zenml-io zenml-io/zenml
Classification
References
-
github.com
/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48d
web, patch
-
huntr.com
/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6
web, exploit, third-party-advisory, evidence
-
nvd.nist.gov
/vuln/detail/CVE-2024-9340
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2025-57.yaml
web
-
github.com
/zenml-io/zenml
package
-
github.com
/advisories/GHSA-6gmf-2369-c76c
advisory
Sources
- CVE List CVE-2024-9340
- GitHub Advisory GHSA-6gmf-2369-c76c
- NVD CVE-2024-9340
- OSV PYSEC-2025-57
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.