Regular Expression Denial of Service (ReDoS) in gradio-app/gradio

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, specifically within the gr.Datetime component. The vulnerable regular expression, ^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$, is used to process user input. Due to polynomial-time matching behavior in Python's default regex engine, crafted inputs can cause excessive backtracking, leading to high CPU consumption [2][3].

The attack surface is exposed via HTTP requests to the Gradio application. An attacker can send a specially crafted request to the gr.Datetime component without requiring authentication, causing the server process to consume 100% CPU. This exploitation does not require network access beyond being able to send HTTP requests to the target service [2][4].

The impact of a successful exploit is a Denial of Service (DoS) condition on the server. The affected version is git commit 98cbcae [1][2]. No workaround is documented, but users are advised to upgrade to a patched version once available, as the vulnerability was identified via the huntr bug bounty platform [4].