Regular Expression Denial of Service in Gradio Affecting Gradio-App

CVE-2024-10624

What is CVE-2024-10624?

A vulnerability exists in the Gradio application affecting the gr.Datetime component due to an inefficient regular expression. The regex ^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$ processes user input inefficiently, leading to a potential Denial of Service (DoS). This can occur when an attacker sends specifically crafted HTTP requests, which cause the Gradio process to consume all CPU resources, thereby destabilizing the server's functioning. This issue highlights the importance of proper input validation and efficient regex handling in application development.

References