BentoML 1.3.9 (bundled Gradio app, /login endpoint): The /login endpoint of the integrated Gradio app processes each

Impact

The /login endpoint of the integrated Gradio app processes each appended character in a malformed multipart boundary, consuming resources until the service is unavailable. No CVE was assigned to the BentoML advisory itself; the underlying Gradio issue is tracked as CVE-2024-8966. Effect on an operator is a model server that stops serving while still holding its GPU.

Who can reach it

Unauthenticated, no user interaction. Anything that can reach the BentoML serving port.

What to do

Upgrade BentoML past 1.3.9 and restart serving pods. Cap request size at the ingress in front of the endpoint as a durable mitigation for this whole class.

References