MediumVulnerability
CVE-2025-32394: AutoGPT denial of service through AITextSummarizerBlock input amplification
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-32394
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
CVE-2025-32394 is a denial-of-service vulnerability in AutoGPT, a workflow automation platform for creating, deploying, and managing continuous AI agents, in versions prior to 0.6.32. The flaw is in AITextSummarizerBlock, where a malicious user can amplify input size, so a 10K input can make the server consume 50G of memory and exhaust memory resources. GitHub, Inc. is the CNA, rating it CVSS 4.0 5.3 MEDIUM.
Mitigation
Fixed in 0.6.32.
Related items
- MediumGHSA-h7c4-q426-7jh9: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsSimilar attack · GitHub Advisory Database
- HighGHSA-4p8p-pjpq-2w7h: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processSimilar attack · GitHub Advisory Database
- HighGHSA-447x-qqwf-m7xq: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSSimilar attack · GitHub Advisory Database
- HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
- MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database