CVE-2024-9340
published 2025-03-20CVE-2024-9340: A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending…
PriorityP346high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
0.90%
55.0th percentile
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zenml-io | zenml-io_zenml | >= unspecified < 0.68.0 | 0.68.0 |
| zenml | zenml | < 0.68.0 | 0.68.0 |
| zenml | zenml | >= 0 < 0.68.0 | 0.68.0 |
| zenml | zenml | >= 0 < cba152eb9ca3071c8372b0b91c02d9d3351de48d | cba152eb9ca3071c8372b0b91c02d9d3351de48d |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ZenML unauthenticated DoS via Multipart Boundry
osv·2025-03-20
CVE-2024-9340 [HIGH] ZenML unauthenticated DoS via Multipart Boundry
ZenML unauthenticated DoS via Multipart Boundry
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.
OSV
CVE-2024-9340: A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0
osv·2025-03-20
CVE-2024-9340 CVE-2024-9340: A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.
GHSA
ZenML unauthenticated DoS via Multipart Boundry
ghsa·2025-03-20
CVE-2024-9340 [HIGH] CWE-400 ZenML unauthenticated DoS via Multipart Boundry
ZenML unauthenticated DoS via Multipart Boundry
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-20
Published