CVE-2024-8966: Gradio Video DoS Vulnerability

CVE-2024-8966 Overview

CVE-2024-8966 is a denial of service vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2. An attacker can append a large number of characters to the end of a multipart boundary in HTTP upload requests. The Gradio server processes each appended character individually and emits warnings for each, exhausting CPU and logging resources. This renders Gradio applications inaccessible for extended periods. The flaw is categorized under [CWE-770: Allocation of Resources Without Limits or Throttling]. The vulnerability is exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can disrupt Gradio-hosted services by sending crafted multipart upload requests, causing sustained service unavailability.

Affected Products

gradio-app/gradio@gradio/video@0.10.2
Gradio deployments relying on python-multipart==0.0.12
Any Gradio application exposing file or video upload endpoints

Discovery Timeline

2025-03-20 - CVE-2024-8966 published to the National Vulnerability Database (NVD)
2025-10-15 - CVE-2024-8966 last updated in NVD

Technical Details for CVE-2024-8966

Vulnerability Analysis

The vulnerability resides in Gradio's multipart form parsing path used for file and video uploads. Gradio relies on the python-multipart library to parse multipart/form-data payloads. When a client submits a request with an excessively long string appended to the multipart boundary token, the underlying parser iterates character-by-character. Each unexpected character triggers a warning, generating significant CPU load and log I/O. Sustained submission of such requests blocks the worker process from servicing legitimate uploads. Because Gradio is commonly fronted by a single FastAPI/Uvicorn process, the impact propagates to the entire application.

Root Cause

The pinned dependency python-multipart==0.0.12 lacks bounds on boundary parsing and warning emission. The fix unpins this dependency and requires python-multipart>=0.0.18, which limits boundary handling cost. The Gradio route handler in gradio/route_utils.py also relaxed its strict typing of multipart.multipart.MultipartCallbacks to align with the upgraded library API.

Attack Vector

An unauthenticated remote attacker sends crafted multipart/form-data HTTP requests to any Gradio endpoint that accepts uploads, such as the video component. The Content-Type header includes a boundary token padded with a large number of characters. Repeated requests sustain the resource exhaustion condition.

python

            raise MultiPartException("Missing boundary in multipart.") from e

        # Callbacks dictionary.
-        callbacks: multipart.multipart.MultipartCallbacks = {
+        callbacks = {
            "on_part_begin": self.on_part_begin,
            "on_part_data": self.on_part_data,
            "on_part_end": self.on_part_end,

Source: Gradio commit f1718c4 - route_utils.py

The accompanying dependency change in requirements.txt is the substantive fix:

text

 pandas>=1.0,<3.0
 pillow>=8.0,<12.0
 pydantic>=2.0
-python-multipart==0.0.12 # required for fastapi forms. pinning to avoid yanking issues with micropip.
+python-multipart>=0.0.18 # required for fastapi forms.
 pydub
 pyyaml>=5.0,<7.0

Source: Gradio commit f1718c4 - requirements.txt

Detection Methods for CVE-2024-8966

Indicators of Compromise

HTTP requests to Gradio endpoints with Content-Type: multipart/form-data containing abnormally long boundary tokens (hundreds or thousands of characters)
High-volume warning entries in Gradio or python-multipart application logs referencing unexpected boundary bytes
Sustained CPU saturation on the Gradio worker process correlated with active upload connections
Rapid growth of application log files without a corresponding rise in successful upload events

Detection Strategies

Inspect reverse-proxy or WAF logs for Content-Type headers where the boundary= parameter exceeds RFC-typical lengths (the RFC 2046 maximum is 70 characters).
Alert on processes generating excessive WARNING log lines per second from multipart modules.
Correlate elevated request latency on /upload and component endpoints with abnormal request body or header characteristics.

Monitoring Recommendations

Track CPU utilization and request latency for Gradio application processes and alert on sustained anomalies.
Enable request-size and header-size limits at the reverse proxy and capture violations for review.
Monitor the version of gradio and python-multipart installed in production environments through software bill of materials (SBOM) tooling.

How to Mitigate CVE-2024-8966

Immediate Actions Required

Upgrade python-multipart to version 0.0.18 or later and upgrade Gradio to a release that includes commit f1718c4.
Enforce Content-Type header length limits at any reverse proxy or load balancer in front of Gradio.
Restrict access to Gradio upload endpoints to authenticated users where the application design permits.
Rate-limit clients posting multipart/form-data requests to upload routes.

Patch Information

The fix is delivered through Gradio commit f1718c47137f9c60240da7afe5e3290aa0f1cb47, which unpins python-multipart and requires >=0.0.18. Additional context is available on the Huntr bounty listing.

Workarounds

Place Gradio behind a reverse proxy (NGINX, HAProxy, or a WAF) configured to reject requests with oversized Content-Type headers.
Disable file or video upload components in Gradio applications that do not require them until patching is complete.
Apply per-client connection and request-rate limits to upload endpoints.

bash

# NGINX example: cap client header size and enforce request rate limits
http {
    large_client_header_buffers 4 8k;
    client_header_buffer_size 1k;

    limit_req_zone $binary_remote_addr zone=gradio_upload:10m rate=5r/s;

    server {
        location /upload {
            limit_req zone=gradio_upload burst=10 nodelay;
            proxy_pass http://gradio_backend;
        }
    }
}