CVE-2025-0187 Denial of Service (DoS) by Sending Large Filename at File Upload Endpoint in gradio-app/gradio

High 7.5 Published 20 Mar 2025 Updated 20 Mar 2025

Attackers can cause denial of service in Gradio by sending file upload requests with excessively large filenames, rendering the server unresponsive.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-0187?

CVE-2025-0187 is a high-severity denial of service vulnerability in Gradio Project Gradio, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users.

Weakness: CWE-400

Which versions are affected by CVE-2025-0187?

It affects 1 product.

Products include Gradio Project Gradio.

How do I fix CVE-2025-0187?

No fix has been published for CVE-2025-0187 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-0187 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-0187 exists.

All Gradio Project Gradio vulnerabilities

Sources

Also known as GHSA-jm82-665g-74jp.