High severity · published Mar 20, 2025
CVE-2024-8018
Denial of Service (DOS) in imartinez/privategpt
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process these characters, rendering privateGPT inaccessible. This uncontrolled resource consumption can lead to prolonged unavailability of the service, disrupting operations and causing potential data inaccessibility and loss of productivity.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
imartinez/privategpt · imartinez
through latest · source: vendor
PR
Privategpt · Pribai
0.5.0 · source: NVD
Affected product
IM
imartinez/privategpt
imartinez
More from imartinez/privategpt
9.8
CVE-2024-4343
Python Command Injection in imartinez/privategpt
7.5
CVE-2024-12063
Denial of Service in imartinez/privategpt
7.5
CVE-2024-3403
Local File Inclusion in imartinez/privategpt
7.2
CVE-2024-5186
Server Side Request Forgery (SSRF) in imartinez/privategpt
6.1
CVE-2024-8029
Stored XSS in imartinez/privategpt