CVE-2024-10569: Gradio vulnerable to denial of service via zip bomb

# CVE-2024-10569: Gradio vulnerable to denial of service via zip bomb

https://gcdradar.vercel.app/incidents/cve-2024-10569-gradio-vulnerable-to-denial-of-service-via-zi · AIR-2025-0248 · closed 2025-03-20

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-03-20
- AI role: Attack on AI
- Products: Gradio
- CVE ids: CVE-2024-10569
- CVSS: 7.5

## Summary

The dataframe component in Gradio is vulnerable to a zip bomb attack through improper handling of input files processed by pd.read_csv. Attackers can exploit this to crash the server and cause a denial of service.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-03-20: CVE-2024-10569: A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. (https://nvd.nist.gov/vuln/detail/CVE-2024-10569)
- 2025-03-20: CVE-2024-10569: Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb (https://github.com/advisories/GHSA-7xmc-vhjp-qv5q)

## Sources

- 2025-03-20 GitHub Advisory Database: CVE-2024-10569: Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb https://github.com/advisories/GHSA-7xmc-vhjp-qv5q
- 2025-03-20 NVD: CVE-2024-10569: A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. https://nvd.nist.gov/vuln/detail/CVE-2024-10569

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.