CVE-2024-9056: BentoML Denial of Service Vulnerability

CVE-2024-9056 Overview

CVE-2024-9056 is a Denial of Service (DoS) vulnerability affecting BentoML version v1.3.4post1. The flaw resides in how the server parses multipart boundary values in HTTP requests. Attackers can append repeating characters, such as dashes (-), to the end of a multipart boundary, forcing the server into excessive character-by-character processing. This results in resource exhaustion and service unavailability.

The vulnerability is unauthenticated, requires no user interaction, and is exploitable over the network. It maps to [CWE-770: Allocation of Resources Without Limits or Throttling]. All users of a vulnerable BentoML deployment lose access when the condition is triggered.

Critical Impact
A single unauthenticated HTTP request with a crafted multipart boundary can render a BentoML service unavailable through CPU and resource exhaustion.

Affected Products

BentoML v1.3.4post1
BentoML deployments exposing HTTP inference endpoints
Machine learning services built on the affected BentoML runtime

Discovery Timeline

2025-03-20 - CVE-2024-9056 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9056

Vulnerability Analysis

BentoML is a Python framework for serving and deploying machine learning models over HTTP. The affected version fails to enforce sane limits when parsing the boundary parameter inside the Content-Type: multipart/form-data HTTP header. When a request arrives with an oversized or padded boundary string, the parser iterates over each trailing character, consuming CPU cycles without bound.

The issue is an algorithmic complexity flaw combined with missing input length validation. Because the parsing loop scales with attacker-controlled input, a small request payload produces disproportionate server work. Concurrent malicious requests amplify the effect, saturating worker threads and blocking legitimate inference traffic.

The EPSS probability for CVE-2024-9056 is 0.664%.

Root Cause

The root cause is unbounded processing of the multipart boundary token. BentoML's HTTP layer does not cap the boundary length or reject malformed padding before entering the parsing routine. This aligns with [CWE-770], where a resource is allocated or consumed without throttling.

Attack Vector

Exploitation requires only network access to a BentoML HTTP endpoint. An attacker sends a POST request with a Content-Type header whose boundary value is padded with a long trailing sequence of dashes or similar characters. The server enters an expensive parsing path for each request, and repeated submissions exhaust CPU and connection resources. No authentication, credentials, or user interaction are required.

Refer to the Huntr Security Bounty disclosure for the reproduction details published by the reporter.

Detection Methods for CVE-2024-9056

Indicators of Compromise

Inbound HTTP requests containing Content-Type: multipart/form-data headers with abnormally long boundary values or excessive trailing dashes.
Sustained CPU saturation on BentoML worker processes without a corresponding increase in successful inference responses.
Elevated request timeouts, dropped connections, or 5xx responses from BentoML endpoints during otherwise normal traffic volumes.

Detection Strategies

Inspect HTTP traffic at a reverse proxy or web application firewall (WAF) and flag Content-Type headers where the boundary parameter exceeds RFC-typical lengths (for example, longer than 70 characters).
Correlate spikes in BentoML process CPU usage with request logs to identify sources sending malformed multipart headers.
Baseline normal request duration for /predict and other BentoML routes, and alert on outliers that exceed established thresholds.

Monitoring Recommendations

Enable structured access logging on the BentoML server or fronting proxy to capture full Content-Type header values.
Monitor per-source-IP request rates and reject or rate-limit clients that produce parser-heavy requests.
Track process-level metrics such as CPU time, thread count, and worker restarts on BentoML hosts.

How to Mitigate CVE-2024-9056

Immediate Actions Required

Upgrade BentoML to a fixed release published after v1.3.4post1 once the maintainers issue a patch. Track the Huntr advisory for release information.
Restrict network exposure of BentoML services by placing them behind an authenticated gateway or private network segment.
Deploy a reverse proxy that validates and normalizes Content-Type headers before requests reach BentoML.

Patch Information

At the time of the last NVD update on 2026-06-17, no vendor advisory URL is recorded for CVE-2024-9056. Administrators should consult the Huntr Security Bounty report and the BentoML project release notes for a fixed version and apply the upgrade to all deployed instances.

Workarounds

Configure the fronting proxy (for example, NGINX or Envoy) to reject requests whose Content-Type header exceeds a strict length limit.
Apply per-client rate limiting and connection quotas to reduce the amplification potential of malicious requests.
Set aggressive request timeouts on BentoML worker processes so that stalled parsing operations terminate before exhausting resources.

bash

# Example NGINX configuration to cap header size and enforce request timeouts
http {
    large_client_header_buffers 4 2k;
    client_header_timeout 5s;
    client_body_timeout 5s;
    send_timeout 5s;

    limit_req_zone $binary_remote_addr zone=bentoml:10m rate=20r/s;

    server {
        listen 443 ssl;
        server_name bentoml.example.com;

        location / {
            limit_req zone=bentoml burst=40 nodelay;
            proxy_pass http://bentoml_upstream;
        }
    }
}