PT-2024-37336 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Published 2024-06-27 · Updated 2025-07-30 · CVE-2024-6038

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt (affected versions not specified)

Description: A Regular Expression Denial of Service (ReDoS) issue exists, located in the filter history function within the utils.py module. This function uses a regular expression search to match a user-provided keyword against chat history filenames. Due to the lack of sanitization or validation of the keyword parameter, an attacker can inject a specially crafted regular expression, leading to a denial of service condition. This can cause severe degradation of service performance and potential system unavailability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-625

CWE-1333

Related Identifiers

CVE-2024-6038

Affected Products

Gaizhenbiao/Chuanhuchatgpt

References · 5

• 🔥 https://huntr.com/bounties/d41cca0a-82bc-4cbf-a52a-928d304fb42d · Exploit
• https://osv.dev/vulnerability/CVE-2024-6038 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6038 · Security Note
• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/fcdd5fd6b05ef537a1db185ab115758d87e1ba3f · Note
• https://t.me/cveNotify/130296 · Telegram Post