CVE-2024-12759
BentoML vulnerable to Uncontrolled Resource Consumption
CVE-2024-12759 has been rejected by its source and should not be treated as a live vulnerability, published March 20, 2025.
** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-8966. Notes: All CVE users should reference CVE-2024-8966 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-hh3j-9m59-p8vc
BentoML vulnerable to Uncontrolled Resource Consumption
In bentoml/bentoml version 1.3.9, the /login endpoint of the newly integrated Gradio app is vulnerable to a Denial of Service (DoS) attack. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction.
- Record
GHSA-hh3j-9m59-p8vc- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-8966. Notes: All CVE users should reference CVE-2024-8966 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.
- Record
CVE-2024-12759- Updated
- 2026-11-02
EUVDEUVD-2025-7007
** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-8966. Notes: All CVE users should reference CVE-2024-8966 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.
- Record
EUVD-2025-7007- CVSS
- 0.0 None
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD No score
Rejected reason: ** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-8966. Notes: All CVE users should reference CVE-2024-8966 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.
- Record
CVE-2024-12759- Updated
- 2026-11-02
OSVGHSA-hh3j-9m59-p8vc
BentoML vulnerable to Uncontrolled Resource Consumption
In bentoml/bentoml version 1.3.9, the /login endpoint of the newly integrated Gradio app is vulnerable to a Denial of Service (DoS) attack. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction.
- Record
GHSA-hh3j-9m59-p8vc- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bentomlPyPI |
through 1.3.9 | None known |
bentomlPyPI |
through 1.3.9, plus listed versions 0.0.10.0.20.0.30.0.50.0.6a0 Show 45 moreShow less0.0.70.0.7.dev00.0.80.0.8.post10.0.90.1.10.1.20.10.00.10.10.11.00.11.dev00.12.00.12.10.13.00.13.10.13.20.2.00.2.10.2.20.3.00.3.10.3.30.3.40.4.00.4.10.4.20.4.30.4.40.4.50.4.70.4.80.4.90.5.00.5.10.5.20.5.30.5.40.5.50.5.60.5.70.5.80.6.00.6.10.6.20.6.3 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
Left out here: 113 versions. The JSON record has them.