EUVD-2025-210364Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated AutoGPT user credentials
-
DeliveryCraft workflow invoking AITextSummarizerBlock with ~10KB payload
-
ExploitSubmit request over network
-
ExecutionServer allocates ~50GB memory without throttling
-
PersistHost memory exhausted
-
ImpactAutoGPT service crashes (DoS for all users)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated user account on the AutoGPT platform (PR:L per the CVSS 4.0 vector) with access to create or trigger workflows that include the AITextSummarizerBlock component. The attack is initiated over the network with no user interaction required beyond the initial request. No special OS privileges, administrative access, or non-default configuration is needed beyond authenticated platform access. Limiting factors: the attacker must hold a legitimate account, and multi-tenant or SaaS deployments where accounts are loosely provisioned present higher risk; self-hosted instances with strict user registration controls reduce exposure. The CVSS 4.0 scope metrics (SC:N/SI:N/SA:N) indicate no confirmed lateral impact beyond the AutoGPT process itself, though host-level OOM conditions may affect other co-located services in practice. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:L) yields a base score of 5.3 and classifies availability impact as low, which is in tension with the description's characterization of full memory exhaustion causing complete denial of service - a discrepancy that defenders should note. A ~50 GB memory spike from a 10 KB payload would realistically OOM-kill or freeze a production server, suggesting VA:H would be more representative. The PR:L requirement (authenticated user) meaningfully limits exposure compared to unauthenticated attacks - only users with valid accounts can trigger this. No EPSS data was provided in the input, and no KEV listing or public POC exists, so real-world exploitation is not confirmed. However, the attack requires no special tools beyond basic HTTP access and a crafted text input, making it trivially reproducible by any authenticated user who becomes aware of the issue. |
| Exploit ScenarioDerived | An authenticated user with a standard account submits a ~10 KB text payload to a workflow invoking AITextSummarizerBlock. The server begins allocating memory to process the summarization task, consuming approximately 50 GB before the system exhausts available RAM and swap, causing the AutoGPT service - and potentially co-located services - to crash. No public exploit code has been identified, but the attack requires only knowledge of the vulnerable block and a valid user session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Memory exhaustion in AutoGPT's AITextSummarizerBlock allows authenticated users to trigger extreme resource amplification - approximately 10 KB of crafted input causes the server to allocate roughly 50 GB of memory, crashing the platform for all users. All versions prior to 0.6.32 are affected per the vendor's GitHub Security Advisory (GHSA-955p-gpfx-r66j). No public exploit or CISA KEV listing has been identified, but the low attack complexity for any authenticated user makes this a realistic internal or multi-tenant threat.
RemediationAI
Vendor-released patch: 0.6.32. Upgrade AutoGPT to version 0.6.32 or later, as confirmed by the vendor's GitHub Security Advisory at https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-955p-gpfx-r66j. If immediate upgrade is not possible, apply compensating controls: restrict access to the AITextSummarizerBlock feature to a minimal set of trusted users via platform-level RBAC; enforce maximum request body size limits at the reverse proxy or API gateway layer (e.g., nginx client_max_body_size) to prevent oversized payloads from reaching the block; and impose container or cgroup memory limits on the AutoGPT server process so that any single runaway allocation is bounded and causes only a process restart rather than host-level exhaustion. Note that capping memory at the container level may cause the AutoGPT process to be OOM-killed mid-request, which can introduce data loss for in-flight workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AutoGPT (by Significant-Gravitas) is a workflow automation platform for building and running autonomous AI agents. The vulnerable component, AITextSummarizerBlock, processes text content for AI-based summarization and fails to enforce limits on memory allocated during processing, conforming to CWE-770 (Allocation of Resources Without Limits or Throttling). The amplification ratio is extreme - approximately 5,000x input-to-memory - suggesting the block may be constructing unbounded intermediate data structures, tokenized representations, or context windows proportional to input without capping allocation. The affected CPE is cpe:2.3:a:significant-gravitas:autogpt:*:*:*:*:*:*:*:*, covering all releases before 0.6.32.
Know when Autogpt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-accessible with low-privilege authenticated access; full server memory exhaustion constitutes high - not low - availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vulnerability in AITextSummarizerBlock. Malicious users can amplify their input. For example, if a malicious user inputs 10K of content, the server will consume 50G of memory, eventually causing memory resources to be exhausted, resulting in DoS. This vulnerability is fixed in 0.6.32.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
DOM-based cross-site scripting in AutoGPT versions prior to 0.6.62 allows remote attackers to execute arbitrary JavaScri
Resource exhaustion denial-of-service in Significant Gravitas AutoGPT versions prior to 0.6.63 allows remote unauthentic
Denial of service in Significant-Gravitas AutoGPT prior to 0.6.63 allows remote attackers to exhaust host disk space by
Denial of service in AutoGPT prior to 0.6.63 allows remote unauthenticated users to exhaust host disk space by chaining
Denial of service in AutoGPT versions prior to 0.6.63 allows remote unauthenticated attackers to exhaust disk space on t
Server-side request forgery in the AutoGPT Platform (versions prior to 0.6.52) lets an authenticated user abuse the Send
Webhook signature verification bypass in AutoGPT Platform before 0.6.70 allows unauthenticated remote attackers to trigg
Insecure deserialization in Significant-Gravitas AutoGPT platform versions 0.6.34 through 0.6.51 lets an attacker who ca
Unauthenticated denial-of-service in AutoGPT Platform versions 0.4.2 through 0.6.51 allows remote attackers to exhaust s
Disk exhaustion denial-of-service in Significant Gravitas AutoGPT prior to version 0.6.63 allows authenticated platform
Authenticated session hijacking in Significant Gravitas AutoGPT versions 0.6.36 through 0.6.50 allows any logged-in user
Improper access control in AutoGPT’s webhook ping endpoint allows any authenticated user to enumerate other users’ webho
Exploit-DB