Denial of Service Vulnerability in Gradio by Gradio App

CVE-2024-10569

What is CVE-2024-10569?

A vulnerability in the dataframe component of Gradio permits attackers to exploit the file processing feature via zip bombs. When users upload compressed files, the system uses pd.read_csv for processing, making it susceptible to an attack that can lead to a server crash, effectively creating a denial of service. This can severely disrupt the application's availability and compromise user experience. Proper validation and handling of file uploads are crucial to mitigate this threat.

References