CVE-2025-32393: AutoGPT Platform DoS Vulnerability

CVE-2025-32393 Overview

CVE-2025-32393 is a Denial of Service (DoS) vulnerability affecting the AutoGPT platform, specifically within the ReadRSSFeedBlock component. AutoGPT is an open-source platform that enables users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The vulnerability allows unauthenticated attackers to exhaust system memory resources by submitting specially crafted deep XML structures through the RSS feed parsing functionality.

Critical Impact

Attackers can remotely crash AutoGPT instances by exploiting unbounded resource allocation in the RSS feed parser, causing complete service disruption without requiring authentication.

Affected Products

• AutoGPT Platform versions prior to autogpt-platform-beta-v0.6.32
• Deployments utilizing the ReadRSSFeedBlock or RSSBlock components
• Self-hosted AutoGPT instances with RSS feed functionality enabled

Discovery Timeline

• February 5, 2026 - CVE-2025-32393 published to NVD
• February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2025-32393

Vulnerability Analysis

This vulnerability falls under CWE-770 (Allocation of Resources Without Limits or Throttling). The core issue resides in the ReadRSSFeedBlock component where the feedparser.parse function is invoked to retrieve and process XML content from user-supplied URLs. The implementation lacks critical safeguards for both parsing timeout limits and memory allocation constraints.

When processing RSS feeds, the application directly passes user-controlled URLs to the XML parser without implementing defensive measures against resource exhaustion attacks. This architectural oversight allows attackers to force the parser to process maliciously constructed XML documents with deeply nested elements or recursive structures, commonly known as "XML bomb" or "billion laughs" style attacks.

The vulnerability is particularly concerning because it requires no authentication to exploit—any user who can interact with the RSS feed functionality can trigger the condition. The network-accessible nature of this attack vector means that remote attackers can target any exposed AutoGPT deployment.

Root Cause

The root cause is the absence of resource limits in the XML parsing implementation within RSSBlock. The feedparser.parse function is called without configuring maximum depth limits, entity expansion limits, or timeout constraints. This allows the parser to consume unbounded memory when processing maliciously crafted XML documents, ultimately leading to memory exhaustion and service unavailability.

Attack Vector

The attack vector is network-based, requiring no user interaction or special privileges. An attacker can craft a malicious RSS feed URL pointing to a server they control, which serves deeply nested XML content designed to consume excessive memory during parsing. When AutoGPT attempts to parse this feed, the recursive or deeply nested structure causes exponential memory allocation, eventually exhausting available system resources and crashing the service.

The attack exploits the inherent trust placed in external RSS feed content. Since the feedparser library attempts to fully parse and process the XML structure before returning results, a carefully constructed payload with recursive entity definitions or deeply nested elements forces the application to allocate memory for the expanded content.

Detection Methods for CVE-2025-32393

Indicators of Compromise

• Unusual memory consumption spikes in AutoGPT processes, particularly during RSS feed operations
• Service crashes or restarts correlated with RSS feed parsing activities
• Requests to ReadRSSFeedBlock or RSSBlock endpoints with URLs pointing to external or suspicious domains
• Log entries showing parsing failures, out-of-memory errors, or timeouts in feed processing components

Detection Strategies

• Monitor memory utilization trends for AutoGPT application processes and alert on abnormal growth patterns
• Implement network monitoring to detect outbound connections from RSS parsing components to untrusted external URLs
• Deploy application-level logging to capture all RSS feed URL submissions and correlate with resource consumption metrics
• Utilize endpoint detection and response (EDR) solutions to identify processes exhibiting memory exhaustion behavior

Monitoring Recommendations

• Configure resource usage alerts for AutoGPT container or process memory consumption exceeding baseline thresholds
• Implement rate limiting on RSS feed parsing requests to reduce the impact of potential DoS attempts
• Enable detailed logging for the ReadRSSFeedBlock component to capture URL inputs and parsing durations
• Monitor for service availability using health checks that can detect unresponsive or crashed AutoGPT instances

How to Mitigate CVE-2025-32393

Immediate Actions Required

• Upgrade to autogpt-platform-beta-v0.6.32 or later immediately to address this vulnerability
• Disable or restrict access to RSS feed functionality if immediate patching is not possible
• Implement network-level filtering to restrict RSS feed URLs to trusted sources only
• Review deployment configurations and restrict AutoGPT access to authenticated users where feasible

Patch Information

The vulnerability has been addressed in autogpt-platform-beta-v0.6.32. The fix implements proper resource limits and timeout constraints for the RSS feed parsing functionality. Detailed patch information is available in the GitHub commit and the GitHub Security Advisory GHSA-5cqw-g779-9f9x.

Workarounds

• Disable the ReadRSSFeedBlock component entirely if RSS feed functionality is not required for your deployment
• Implement a reverse proxy or web application firewall (WAF) to filter and validate RSS feed URLs before they reach AutoGPT
• Configure container or process memory limits to prevent a single parsing operation from exhausting system resources
• Use network segmentation to isolate AutoGPT instances and limit the blast radius of potential DoS attacks

# Example: Set container memory limits for AutoGPT deployment
# This limits the impact of memory exhaustion attacks
docker run -d --memory="2g" --memory-swap="2g" autogpt:latest

# Example: Restrict outbound connections for RSS parsing (iptables)
# Allow only trusted RSS feed sources
iptables -A OUTPUT -p tcp --dport 443 -d trusted-rss-domain.com -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -m owner --uid-owner autogpt -j DROP