From 14071a28b00dd83c6c69a4a7c87fb26c10ddc8fe Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 21 Mar 2025 03:37:35 +0000
Subject: [PATCH] Publish GHSA-hw8j-hw49-752c

---
 .../GHSA-hw8j-hw49-752c.json                  | 41 +++++++++++++++++--
 1 file changed, 37 insertions(+), 4 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2025/03/GHSA-hw8j-hw49-752c/GHSA-hw8j-hw49-752c.json (53%)

diff --git a/advisories/unreviewed/2025/03/GHSA-hw8j-hw49-752c/GHSA-hw8j-hw49-752c.json b/advisories/github-reviewed/2025/03/GHSA-hw8j-hw49-752c/GHSA-hw8j-hw49-752c.json
similarity index 53%
rename from advisories/unreviewed/2025/03/GHSA-hw8j-hw49-752c/GHSA-hw8j-hw49-752c.json
rename to advisories/github-reviewed/2025/03/GHSA-hw8j-hw49-752c/GHSA-hw8j-hw49-752c.json
index dae070c294d..9c8973d0948 100644
--- a/advisories/unreviewed/2025/03/GHSA-hw8j-hw49-752c/GHSA-hw8j-hw49-752c.json
+++ b/advisories/github-reviewed/2025/03/GHSA-hw8j-hw49-752c/GHSA-hw8j-hw49-752c.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hw8j-hw49-752c",
-  "modified": "2025-03-20T12:32:50Z",
+  "modified": "2025-03-21T03:36:02Z",
   "published": "2025-03-20T12:32:50Z",
   "aliases": [
     "CVE-2024-9056"
   ],
+  "summary": "BentoML Denial of Service (DoS) via Multipart Boundary",
   "details": "BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. This causes the server to continuously process each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.",
   "severity": [
     {
@@ -13,12 +14,44 @@
       "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "bentoml"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.4.5"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9056"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/bentoml/BentoML"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/bentoml/BentoML/blob/a6f5f937be6ec278f3d4f3bbc6f3c8f9564820d7/src/bentoml/_internal/io_descriptors/file.py#L293"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/bentoml/BentoML/blob/v1.4.5/src/bentoml/_internal/io_descriptors/file.py#L293C9-L293C66"
+    },
     {
       "type": "WEB",
       "url": "https://huntr.com/bounties/a24a13c2-0300-4a95-b26a-ac7fe8f6521b"
@@ -29,8 +62,8 @@
       "CWE-400"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-21T03:36:02Z",
     "nvd_published_at": "2025-03-20T10:15:46Z"
   }
 }
\ No newline at end of file