Skip to main content

Undefined Behavior for Input to API

CVE-2024-10569

High
7.5/10

Summary

A vulnerability in the dataframe component of gradio-app/gradio allows for a zip bomb attack. The component uses "pd.read_csv" to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server crash and causing a Denial of Service (DoS). This issue affects versions 4.0.0b15 and after.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-475 - Undefined Behavior for Input to API

The behavior of this function is undefined unless its control parameter is set to a specific value.

References

Advisory Timeline

  • Published