CVE-2024-12063 HIGH

CVE-2024-12063: Denial of Service in imartinez/privategpt

Vendor Imartinez
Product imartinez/privategpt
Weakness CWE-400
Published March 20, 2025
Last update March 20, 2025

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated