Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Gradio

CVE-2024-10624: Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

highCVSS 3.0 7.5GHSA-rvgh-pr46-x7gg

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression ^(?:\snow\s(?:-\s(\d+)\s([dmhs]))?)?\s$ to process user input.

Published Mar 20, 2025 · Updated Oct 15, 2025

Affected packages

gradio

Ecosystem
PyPI
Affected
>= 4.38.0, <= 5.0.0-beta.2
Fixed in
No patched version yet
Check
pip show gradio

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression ^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$ to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Gradio vulnerabilities

All Gradio entries