A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48d | Patch |
| https://huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6 | Exploit Third Party Advisory |
Configurations
History
15 Jul 2025, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
27 Jun 2025, 15:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Zenml zenml
Zenml |
|
| CWE | CWE-835 | |
| CPE | cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:* | |
| References | () https://github.com/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48d - Patch | |
| References | () https://huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6 - Exploit, Third Party Advisory |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-15 11:15
NVD link : CVE-2024-9340
Mitre link : CVE-2024-9340
JSON object : View
Products Affected
zenml
- zenml
CWE
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')