{"data":{"id":"75abbaad-61d5-4a0f-b40f-4a45167bd02b","title":"CVE-2024-9056: BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by…","summary":"BentoML v1.3.4post1 contains a denial-of-service flaw, tracked as CVE-2024-9056 and classified under CWE-770 (Allocation of Resources Without Limits or Throttling). An unauthenticated attacker can append characters such as dashes (-) to the end of a multipart boundary in an HTTP request, causing the server to process each character continuously, consuming excessive resources and making the service unavailable for all users.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-9056","publishedAt":"2025-03-20T14:15:46.453Z","cveId":"CVE-2024-9056","cweIds":["CWE-770"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["bentoml@<= 1.4.5"],"affectedPackageNames":["bentoml"],"affectedPackageRefs":["pypi:bentoml"],"affectedVendors":[],"affectedVendorsRaw":["BentoML"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"BentoML denial of service through malformed multipart boundary in HTTP request","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00725,"epssCheckedAt":"2026-11-04T12:08:33.171Z","kevDateAdded":null,"advisoryAliases":["GHSA-hw8j-hw49-752c"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:11.486Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}