CVE-2024-10624 Overview
CVE-2024-10624 is a Regular Expression Denial of Service (ReDoS) vulnerability in the gradio-app/gradio repository. The flaw resides in the gr.Datetime component and affects git commit 98cbcae. The component uses the regular expression ^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$ to parse user-supplied datetime input. Python's default regex engine exhibits polynomial matching time against crafted inputs to this pattern. An unauthenticated remote attacker can send crafted HTTP requests that force the Gradio process to consume 100% CPU. Sustained exploitation renders the server unresponsive and produces a Denial of Service condition. The weakness is categorized under [CWE-1333] Inefficient Regular Expression Complexity.
Critical Impact
Unauthenticated remote attackers can exhaust CPU resources on any Gradio server exposing the gr.Datetime component, taking the application offline without credentials or user interaction.
Affected Products
- gradio-app/gradio (Python package)
- Git commit 98cbcae (dated 2024-09-18)
- Applications embedding the gr.Datetime component
Discovery Timeline
- 2025-03-20 - CVE-2024-10624 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10624
Vulnerability Analysis
The gr.Datetime component accepts free-form user input to describe relative timestamps such as now - 5d. Input is validated against the regular expression ^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$. The pattern contains nested optional groups combined with unbounded whitespace quantifiers (\s*) at multiple positions. Python's re module uses a backtracking engine, and crafted inputs cause the engine to explore an exponentially growing set of match paths. Matching a single malicious string can occupy the worker thread for seconds to minutes, blocking the Gradio event loop and starving legitimate requests.
Root Cause
The vulnerability stems from an inefficient regular expression that contains ambiguous whitespace matching across nested optional groups. When Python's backtracking regex engine encounters input that partially satisfies the pattern, it retries many permutations before failing. This behavior is a classic algorithmic complexity flaw tracked as [CWE-1333]. The developer relied on a single regex for both parsing and validation without pre-normalizing input or enforcing a maximum input length.
Attack Vector
Exploitation requires only network access to a Gradio application exposing the gr.Datetime component. An attacker sends an HTTP request containing a crafted string, such as a long sequence of whitespace and partial now - tokens that never fully satisfies the pattern. The server thread evaluating the regex consumes 100% CPU while backtracking. Repeated requests from a single client can exhaust all worker processes, producing a full application outage. No authentication, privilege, or user interaction is required.
See the Huntr Bug Bounty Report for the proof-of-concept payload and reproduction steps.
Detection Methods for CVE-2024-10624
Indicators of Compromise
- Sustained CPU utilization at or near 100% within Gradio worker processes without corresponding request throughput
- HTTP POST requests to Gradio component endpoints containing long whitespace sequences or repeated now - fragments in datetime fields
- Increased request latency and timeouts on endpoints backed by the gr.Datetime component
Detection Strategies
- Inspect application logs for repeated requests targeting the gr.Datetime endpoint with unusually long payloads or malformed relative time syntax
- Correlate spikes in per-process CPU time with inbound HTTP requests to identify regex-driven exhaustion patterns
- Deploy Web Application Firewall (WAF) rules that flag datetime parameter values exceeding a reasonable length threshold, for example 64 characters
Monitoring Recommendations
- Track CPU utilization per Gradio worker and alert on sustained saturation lasting more than a few seconds
- Monitor request duration percentiles (p95, p99) for endpoints handling datetime input
- Enable rate limiting and log source IP addresses of repeat offenders for retrospective analysis
How to Mitigate CVE-2024-10624
Immediate Actions Required
- Upgrade Gradio to a release published after git commit 98cbcae (post 2024-09-18) that removes or refactors the vulnerable regular expression
- Restrict network exposure of Gradio applications to trusted networks or authenticated users where feasible
- Deploy a WAF rule that rejects datetime field values exceeding a fixed maximum length before they reach the application
Patch Information
The Gradio maintainers addressed the ReDoS issue after the report submitted through the Huntr Bug Bounty Report. Upgrade to the current Gradio release from PyPI and verify that the gr.Datetime component parses input using a bounded parser rather than the vulnerable backtracking pattern.
Workarounds
- Enforce a strict server-side input length limit on any parameter feeding gr.Datetime before regex evaluation
- Replace the vulnerable pattern with an anchored, non-backtracking parser or use regex module features such as atomic groups if a code override is required
- Apply per-source-IP rate limiting on Gradio endpoints to reduce the impact of repeated malicious requests
# Upgrade Gradio to a patched release
pip install --upgrade gradio
# Verify the installed version
python -c "import gradio; print(gradio.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
