CVE-2024-9340

🗓️ 20 Mar 2025 10:08:50Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 88 Views🌐 WEB

Denial of Service vulnerability in zenml-io/zenml version 0.66.0 affects multiple endpoints, allowing resource exhaustion.

Reporter	Title	Published	Views	Family All 13
CNNVD	ZenML 资源管理错误漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-9340 Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml	20 Mar 202510:08	–	cvelist
EUVD	EUVD-2025-6854	3 Oct 202520:07	–	euvd
Github Security Blog	ZenML unauthenticated DoS via Multipart Boundry	20 Mar 202512:32	–	github
NVD	CVE-2024-9340	20 Mar 202510:15	–	nvd
OSV	GHSA-6GMF-2369-C76C ZenML unauthenticated DoS via Multipart Boundry	20 Mar 202512:32	–	osv
OSV	PYSEC-2025-57	20 Mar 202510:15	–	osv
Positive Technologies	PT-2025-12276 · Zenml · Zenml	20 Mar 202500:00	–	ptsecurity
PyPA	PYSEC-2025-57	20 Mar 202510:15	–	pypa
RedhatCVE	CVE-2024-9340	22 Mar 202511:46	–	redhatcve

NVD

Vulners

Node

zenml zenmlRange<0.68.0

[
  {
    "vendor": "zenml-io",
    "product": "zenml-io/zenml",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "0.68.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6
github	www.github.com/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48d

Parameter	Position	Path	Description	CWE
Content-Type	header	/api/v1/login	DoS via malformed multipart boundary causing infinite loop on login endpoint	CWE-835
Content-Type	header	/api/v1/device_authorization	DoS via malformed multipart boundary causing infinite loop on device authorization endpoint	CWE-835

17 Jun 2026 08:24Current

7.6High risk

Vulners AI Score7.6

CVSS 37.5

EPSS0.00896

SSVC

CWE-835