CVE-2025-32394
Received Received - Intake
Denial of Service in AutoGPT AITextSummarizerBlock

Publication date: 2026-06-26

Last updated on: 2026-06-26

Assigner: GitHub, Inc.

Description
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vulnerability in AITextSummarizerBlock. Malicious users can amplify their input. For example, if a malicious user inputs 10K of content, the server will consume 50G of memory, eventually causing memory resources to be exhausted, resulting in DoS. This vulnerability is fixed in 0.6.32.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-26
Last Modified
2026-06-26
Generated
2026-06-26
AI Q&A
2026-06-26
EPSS Evaluated
N/A
NVD
CVE-2025-32394
EUVD
EUVD-2025-210364
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
significant_gravitas autogpt to 0.6.32 (exc)
significant_gravitas autogpt 0.6.32
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-405 The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The CVE-2025-32394 vulnerability is a denial-of-service (DoS) issue in the AITextSummarizerBlock of AutoGPT, specifically in the chunking mechanism of the _split_text function in llm.py.

Malicious users can exploit this vulnerability by manipulating the max_tokens and overlap parameters, which are user-controlled inputs, to cause quadratic memory amplification.

For example, an input of 10KB can cause the server to consume up to 50GB of memory, exhausting memory resources and resulting in a DoS condition.

This vulnerability affects versions of AutoGPT up to 0.6.31 and was fixed in version 0.6.32.

Impact Analysis

This vulnerability can lead to a denial-of-service (DoS) condition by exhausting the server's memory resources.

An attacker can cause the system to consume excessive memory, potentially making the AutoGPT service unavailable to legitimate users.

This can disrupt workflow automation processes that rely on AutoGPT, causing downtime and impacting business operations.

Detection Guidance

This vulnerability can be detected by monitoring for unusually high memory consumption by the AutoGPT process, especially when processing inputs to the AITextSummarizerBlock. Since the issue involves the `max_tokens` and `overlap` parameters being manipulated to cause excessive memory use, checking these parameters in use or logs may help identify exploitation attempts.

There are no specific commands provided to detect this vulnerability directly, but general system monitoring commands can be used to observe memory usage spikes during AutoGPT operation.

  • Use `top` or `htop` to monitor memory usage of the AutoGPT process in real time.
  • Use `ps aux --sort=-%mem | grep autogpt` to identify if AutoGPT is consuming excessive memory.
  • Check application logs for unusually large inputs or abnormal values for `max_tokens` and `overlap` parameters.
Mitigation Strategies

The immediate mitigation step is to upgrade AutoGPT to version 0.6.32 or later, where this vulnerability has been fixed.

Until the upgrade can be applied, restrict or validate user inputs to the AITextSummarizerBlock, especially limiting the `max_tokens` and `overlap` parameters to prevent memory amplification.

Additionally, monitor system memory usage closely to detect and respond to potential denial-of-service conditions caused by this vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-32394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart