BentoML vulnerable to Uncontrolled Resource Consumption
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- —
- Fix status
- No fix listed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-400.
Summary
In bentoml/bentoml version 1.3.9, the `/login` endpoint of the newly integrated Gradio app is vulnerable to a Denial of Service (DoS) attack. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | bentoml (PyPI) | up to 1.3.9 | — | No fix listed | GHSA-hh3j-9m59-p8vc |
- bentoml (PyPI) Vendor— Affected up to 1.3.9 Fixed in — No fix listed GHSA-hh3j-9m59-p8vc
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-03 Threatist record created from GHSA-hh3j-9m59-p8vc
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences