CVE-2024-9056High· 7.5▾ TwilightBentoML Denial of Service (DoS) via Multipart Boundary
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.7%
0.7% → 0.7%
BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. This causes the server to continuously process each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.
bentoml <= 1.4.5Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-2912Critical· 9.8Insecure deserialization in BentoML
CVE-2024-9070Critical· 9.8BentoML deserialization vulnerability
CVE-2025-54381Critical· 9.9BentoML SSRF Vulnerability in File Upload Processing
CVE-2025-27520Critical· 9.8BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
CVE-2026-40610Medium· 5.5BentoML is a Python library for building online serving systems optimized for AI apps and model inference
CVE-2026-27905High· 7.8BentoML is a Python library for building online serving systems optimized for AI apps and model inference