CVE-2024-10624
published 2025-03-20CVE-2024-10624: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected…
PriorityP341high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
1.01%
58.9th percentile
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$` to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gradio-app | gradio-app_gradio | unspecified – latest | — |
| gradio_project | gradio | — | — |
| gradio_project | gradio | 4.38.0 – 5.0.0-beta.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
ghsa·2025-03-20
CVE-2024-10624 [HIGH] CWE-1333 Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$` to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.
OSV
Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
osv·2025-03-20
CVE-2024-10624 [HIGH] Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$` to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-20
Published