PT-2025-12068 · Unknown · Eosphoros-Ai/Db-Gpt

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-10829

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions eosphoros-ai/db-gpt version 0.6.0

Description A Denial of Service (DoS) issue exists in the multipart request boundary processing mechanism, allowing unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and complete denial of service for all users. This issue affects all endpoints processing multipart/form-data requests.

Recommendations For eosphoros-ai/db-gpt version 0.6.0, consider restricting access to endpoints that process multipart/form-data requests until a patch is available. As a temporary workaround, limiting the length of multipart boundaries may help mitigate the risk of exploitation.

Exploit

Fix

DoS

Resource Exhaustion

Infinite Loop

Weakness Enumeration

CWE-400

CWE-835

Related Identifiers

CVE-2024-10829

GHSA-6XGJ-C5FX-5V57

Affected Products

Eosphoros-Ai/Db-Gpt

References · 6

• 🔥 https://huntr.com/bounties/e3a4a0ad-a2e0-497f-a2e0-e3c0ec7c4de4 · Exploit
• https://osv.dev/vulnerability/CVE-2024-10829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10829 · Security Note
• https://osv.dev/vulnerability/GHSA-6xgj-c5fx-5v57 · Vendor Advisory
• https://github.com/eosphoros-ai/DB-GPT · Note
• https://twitter.com/CVEnew/status/1902968865602293868 · Twitter Post