high7.5
CVE-2024-10624
Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
Impact
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$` to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | gradio | >= 4.38.0, <= 5.0.0-beta.2 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gradio Project | Gradio | Version 2024-09-18 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://huntr.com/bounties/e8d0b248-8feb-4c23-9ef9-be4d1e868374
- https://github.com/advisories/GHSA-rvgh-pr46-x7gg
- https://nvd.nist.gov/vuln/detail/CVE-2024-10624
- https://github.com/gradio-app/gradio/blob/98cbcaef827de7267462ccba180c7b2ffb1e825d/gradio/components/datetime.py#L133-L136