OpenVINO Model Server: An unauthenticated request can drive OpenVINO Model Server into unbounded resource consumption

Impact

An unauthenticated request can drive OpenVINO Model Server into unbounded resource consumption and take the endpoint down. Cheap remote DoS against a serving tier.

Who can reach it

Anyone who can send a request to the model server.

What to do

Upgrade OpenVINO Model Server to 2024.4 or later, and put request-size and rate limits in front of the endpoint. Rolling container restart.

References