CVE-2024-8018: Denial of Service (DOS) in imartinez/privategpt
First published: Thu Mar 20 2025(Updated: )
A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process these characters, rendering privateGPT inaccessible. This uncontrolled resource consumption can lead to prolonged unavailability of the service, disrupting operations and causing potential data inaccessibility and loss of productivity.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| imartinez privategpt |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-8018?
CVE-2024-8018 is classified as a Denial of Service (DoS) vulnerability, which can disrupt the availability of the application.
How do I fix CVE-2024-8018?
To mitigate CVE-2024-8018, you should upgrade to a patched version of imartinez/privategpt that resolves this issue.
Which version of privategpt is affected by CVE-2024-8018?
CVE-2024-8018 affects version 0.5.0 of imartinez/privategpt.
What type of attack is enabled by CVE-2024-8018?
CVE-2024-8018 allows for a Denial of Service (DoS) attack by manipulating the multipart boundary during file uploads.
Is there a workaround for CVE-2024-8018?
A potential workaround for CVE-2024-8018 is to limit the size of uploads or to validate input thoroughly before processing.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/severity
- agent/source
- agent/tags
- agent/event
- vendor/imartinez
- canonical/imartinez privategpt