---
id: CVE-2024-8966
aliases:
  - GHSA-5cpq-9538-jm2j
  - PYSEC-2026-1410
title: Gradio DOS in multipart boundry while uploading the file
summary: Gradio DOS in multipart boundry while uploading the file
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: gradio
product: gradio
ecosystem: pip
affected:
  - gradio <= 5.22.0
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5cpq-9538-jm2j'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8966'
  - url: >-
      https://github.com/gradio-app/gradio/commit/f1718c47137f9c60240da7afe5e3290aa0f1cb47
  - url: 'https://github.com/gradio-app/gradio'
  - url: 'https://huntr.com/bounties/7b5932bb-58d1-4e71-b85c-43dc40522ff2'
tags:
  - osv
  - pip
epss: 0.0079
epssPercentile: 0.54328
ingestedAt: '2026-07-08T18:25:45.972Z'
---

## Overview

A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue warnings. This can render Gradio inaccessible for extended periods, disrupting services and causing significant downtime.

## Affected packages

- `gradio <= 5.22.0`

## Remediation

Refer to the advisory for the patched release.