Executive Summary

CVE-2025-32423 is a denial-of-service (DoS) vulnerability in the AutoGPT platform, specifically in the ExtractTextInformationBlock component.

The vulnerability is caused by a user-controlled regular expression that can produce output with O(n^2) complexity, leading to excessive memory consumption.

For example, if a malicious user inputs 10,000 characters, the server may consume up to 50GB of memory due to the uncontrolled regex pattern and group selection, which amplifies the input size exponentially.

This memory exhaustion results in a denial-of-service condition, making the system unavailable.

The vulnerability affects versions of autogpt-platform-beta up to v0.6.31 and was fixed in version 0.6.32.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a denial-of-service (DoS) condition on the AutoGPT platform.

An attacker can exploit the vulnerability by sending specially crafted input that causes the server to consume excessive memory, potentially up to 50GB for a 10,000 character input.

This memory exhaustion can lead to system crashes, degraded performance, or unavailability of the service, disrupting normal operations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusually high memory consumption by the AutoGPT service, especially when processing large or complex text inputs. Since the issue arises from a user-controlled regular expression causing exponential memory usage, observing memory spikes during text extraction operations is a key indicator.

Additionally, checking the version of AutoGPT or autogpt-platform-beta installed on your system can help identify if the vulnerable version (prior to 0.6.32) is in use.

• Use commands to check the installed version, for example:
• ```bash autogpt --version # or pip show autogpt ```
• Monitor memory usage of the AutoGPT process during operation, for example:
• ```bash top -p $(pidof autogpt) # or ps aux | grep autogpt ```
• Check logs for any signs of memory exhaustion or crashes related to text extraction.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and most effective mitigation is to upgrade AutoGPT or autogpt-platform-beta to version 0.6.32 or later, where this vulnerability has been fixed.

Until the upgrade can be performed, consider restricting or sanitizing user inputs to the ExtractTextInformationBlock component to prevent excessively large or maliciously crafted text inputs that could trigger the memory exhaustion.

Additionally, monitor system memory usage closely and implement resource limits or timeouts on text processing operations to reduce the risk of denial-of-service.

Useful 0 Not Useful 0