CVE-2024-9340

Katalog CVE

CVSS 7.5 · High EPSS 0,97%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada zenml. Skor CVSS 3.0 7.5 (High) menurut huntr.dev.

Deskripsi (NVD)

A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.0

7.5 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,97% peluang dieksploitasi; lebih tinggi dari 60,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48d patch
• https://huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6 exploit · advisory pihak ketiga