CVE-2024-8966: Gradio DOS in multipart boundry while uploading the file

March 20, 2025 (updated October 15, 2025)

A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue warnings. This can render Gradio inaccessible for extended periods, disrupting services and causing significant downtime.

References

github.com/advisories/GHSA-5cpq-9538-jm2j
github.com/gradio-app/gradio
github.com/gradio-app/gradio/commit/f1718c47137f9c60240da7afe5e3290aa0f1cb47
huntr.com/bounties/7b5932bb-58d1-4e71-b85c-43dc40522ff2
nvd.nist.gov/vuln/detail/CVE-2024-8966

Code Behaviors & Features

Detect and mitigate CVE-2024-8966 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →