CVE-2025-32394: AutoGPT DoS Vulnerability

CVE-2025-32394 Overview

CVE-2025-32394 is a denial-of-service vulnerability in AutoGPT, a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. The flaw resides in the AITextSummarizerBlock component and affects all versions prior to 0.6.32. Authenticated attackers can amplify a small input into massive memory consumption on the server. According to the vendor advisory, a 10 KB input can cause the server to allocate approximately 50 GB of memory. This resource amplification exhausts host memory and results in service disruption. The issue is classified as [CWE-405] Asymmetric Resource Consumption (Amplification) and is fixed in version 0.6.32.

Critical Impact
A low-privileged authenticated user can trigger 5,000,000x memory amplification, exhausting server resources and taking AutoGPT deployments offline.

Affected Products

AutoGPT (Significant-Gravitas/AutoGPT) versions prior to 0.6.32
Deployments exposing the AITextSummarizerBlock to user-supplied input
Self-hosted AutoGPT instances accepting authenticated API requests

Discovery Timeline

2026-06-26 - CVE-2025-32394 published to NVD
2026-06-27 - Last updated in NVD database

Technical Details for CVE-2025-32394

Vulnerability Analysis

AutoGPT provides modular blocks that process input for AI agent workflows. The AITextSummarizerBlock accepts text and prepares it for summarization. The block does not enforce bounded resource usage during preprocessing. As a result, input size and memory allocation scale non-linearly. A modest payload produces disproportionately large in-memory structures. The vendor advisory documents a ratio in which 10 KB of input consumes roughly 50 GB of memory. Once resident memory is exhausted, the AutoGPT process terminates or the host becomes unresponsive, denying service to legitimate agents and users.

Root Cause

The root cause is asymmetric resource consumption [CWE-405] inside AITextSummarizerBlock. The block does not validate or cap the input length or the size of derived intermediate data structures before allocation. This allows a small attacker-controlled input to generate an outsized memory footprint on the server.

Attack Vector

Exploitation requires network access and low-level authenticated privileges (PR:L) but no user interaction. An attacker submits crafted text to a workflow that invokes AITextSummarizerBlock. The server allocates memory proportional to the amplified representation of the input. Repeated or single large requests exhaust available memory and induce denial of service. Because AutoGPT is typically deployed for continuous agent operation, service loss disrupts all agents on the affected host.

No public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-955p-gpfx-r66j for vendor-provided technical detail.

Detection Methods for CVE-2025-32394

Indicators of Compromise

Sudden, sustained memory growth in the AutoGPT server process without a matching increase in request volume
Out-of-memory (OOM) kills in system logs correlated with API calls invoking summarizer blocks
Repeated failed or timed-out requests to endpoints that execute AITextSummarizerBlock
Authenticated API calls originating from unexpected accounts or IP ranges targeting summarizer workflows

Detection Strategies

Monitor AutoGPT process resident set size (RSS) and alert on rapid growth exceeding container or host limits
Log and inspect request payloads sent to workflows that include AITextSummarizerBlock for anomalous input patterns
Correlate kernel OOM killer events with AutoGPT API access logs to identify triggering requests
Track authenticated user activity for repeated invocations of summarizer blocks within short intervals

Monitoring Recommendations

Enable cgroup or container memory limits with alerting when usage crosses 80% of allocated quota
Export AutoGPT metrics to a centralized SIEM or observability platform and build alerts on request-to-memory ratio anomalies
Retain API access logs for a minimum of 90 days to support post-incident investigation of DoS attempts

How to Mitigate CVE-2025-32394

Immediate Actions Required

Upgrade AutoGPT to version 0.6.32 or later on all self-hosted and managed deployments
Audit user accounts with access to workflows that invoke AITextSummarizerBlock and revoke unused credentials
Apply container or systemd memory limits to bound the impact of any residual resource-exhaustion vector
Restrict network exposure of the AutoGPT API to trusted networks or authenticated VPN users

Patch Information

The vulnerability is fixed in AutoGPT version 0.6.32. Upgrade instructions and the security advisory are available in the GitHub Security Advisory GHSA-955p-gpfx-r66j. Operators should verify the running version after upgrade and redeploy any agents that depend on the summarizer block.

Workarounds

Disable or remove workflows that use AITextSummarizerBlock until the upgrade is applied
Place a reverse proxy in front of AutoGPT to enforce request body size limits on API endpoints
Rate-limit authenticated API calls per user or token to slow amplification attempts
Run AutoGPT under strict cgroup memory limits so an exhausted process is restarted rather than crashing the host

bash

# Configuration example: enforce container memory limit and request size cap
docker run --name autogpt \
  --memory=4g --memory-swap=4g \
  -p 8000:8000 \
  significantgravitas/autogpt:0.6.32

# Example nginx reverse-proxy limit for AutoGPT API
# /etc/nginx/conf.d/autogpt.conf
server {
    listen 443 ssl;
    server_name autogpt.example.com;
    client_max_body_size 64k;
    location / {
        proxy_pass http://127.0.0.1:8000;
    }
}