CVE-2024-8018: Denial of Service (DOS) in imartinez/privategpt

Published Mar 20, 2025

Updated

A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process these characters, rendering privateGPT inaccessible. This uncontrolled resource consumption can lead to prolonged unavailability of the service, disrupting operations and causing potential data inaccessibility and loss of productivity.

Affected Software

2 affected components

imartinez privategpt

Pribai Privategpt=0.5.0

Event History

Mar 20, 2025

CVE Published

via MITRE·10:10 AM

Data Sourced

via MITRE·10:10 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-8018?

CVE-2024-8018 is classified as a Denial of Service (DoS) vulnerability, which can disrupt the availability of the application.

How do I fix CVE-2024-8018?

To mitigate CVE-2024-8018, you should upgrade to a patched version of imartinez/privategpt that resolves this issue.

Which version of privategpt is affected by CVE-2024-8018?

CVE-2024-8018 affects version 0.5.0 of imartinez/privategpt.

What type of attack is enabled by CVE-2024-8018?

CVE-2024-8018 allows for a Denial of Service (DoS) attack by manipulating the multipart boundary during file uploads.

Is there a workaround for CVE-2024-8018?

A potential workaround for CVE-2024-8018 is to limit the size of uploads or to validate input thoroughly before processing.