What’s Vulnerable › Vulnerabilities

CVE-2024-9340: Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-20 · updated 2026-06-17
• Weakness: CWE-835

Description

A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.

Affected products

• zenml-io/zenml: before 0.68.0 — fixed in 0.68.0

How to fix

Upgrade to a fixed version: zenml-io/zenml 0.68.0. Check the vendor advisory for mitigations.

References

• https://github.com/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48d
• https://huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6

Get alerted when CVE-2024-9340 or the next vulnerability affects your stack