CVE-2024-9340

A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48d	Patch
https://huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-20 10:15

Updated : 2025-07-15 11:15

NVD link : CVE-2024-9340

Mitre link : CVE-2024-9340

CVE.ORG link : CVE-2024-9340

JSON object : View

Products Affected

zenml

zenml

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2024-9340", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-03-20T10:15:48.100", "references": [{"url": "https://github.com/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48d", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-835"}]}, {"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`."}, {"lang": "es", "value": "Una vulnerabilidad de denegaci\u00f3n de servicio (DoS) en zenml-io/zenml versi\u00f3n 0.66.0 permite a atacantes no autenticados consumir recursos excesivamente mediante el env\u00edo de solicitudes multiparte malformadas con caracteres arbitrarios a\u00f1adidos al final de los l\u00edmites. Esta falla en el mecanismo de procesamiento de los l\u00edmites de solicitudes multiparte genera un bucle infinito, lo que resulta en una denegaci\u00f3n de servicio completa para todos los usuarios. Los endpoints afectados incluyen `/api/v1/login` y `/api/v1/device_authorization`."}], "lastModified": "2025-07-15T11:15:24.300", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AE0A162-5652-47CD-8840-FDA3C425F0ED", "versionEndExcluding": "0.68.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}