Skip to content
OpenAdvisories
High · 7.5 CVE-2024-9340 EUVD-2025-6854GHSA-6gmf-2369-c76cPYSEC-2025-57

Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml

Published Mar 20, 2025 · Updated Jul 15, 2025 · Assigned by @huntr_ai

Description

A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.

Affected products

VendorProductAffectedFixed
zenml-io zenml-io/zenml unspecified – < 0.68.0 0.68.0

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI zenml < 0.68.0 0.68.0 GHSA-6gmf-2369-c76c

References