Regular Expression Denial of Service in Gradio Affecting Gradio-App

CVE-2024-10624

What is CVE-2024-10624?

A vulnerability exists in the Gradio application affecting the gr.Datetime component due to an inefficient regular expression. The regex ^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$ processes user input inefficiently, leading to a potential Denial of Service (DoS). This can occur when an attacker sends specifically crafted HTTP requests, which cause the Gradio process to consume all CPU resources, thereby destabilizing the server's functioning. This issue highlights the importance of proper input validation and efficient regex handling in application development.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References