CVE-2024-9056: BentoML denial of service through malformed multipart boundary in HTTP request

Summary

BentoML v1.3.4post1 contains a denial-of-service flaw, tracked as CVE-2024-9056 and classified under CWE-770 (Allocation of Resources Without Limits or Throttling). An unauthenticated attacker can append characters such as dashes (-) to the end of a multipart boundary in an HTTP request, causing the server to process each character continuously, consuming excessive resources and making the service unavailable for all users.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• bentomlPyPINo LLM dependency detected · 1 tracked dependent

Related items

• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
• InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
• LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog