CVE-2025-32423: AutoGPT DoS Vulnerability

CVE-2025-32423 Overview

CVE-2025-32423 is a denial of service (DoS) vulnerability in AutoGPT, a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. The flaw resides in the ExtractTextInformationBlock component in versions prior to 0.6.32. An authenticated user can submit a small input that the server amplifies during processing, exhausting available memory. According to the vendor advisory, a 10KB input can force the server to allocate approximately 50GB of memory. The issue is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling) and is fixed in version 0.6.32.

Critical Impact
A low-privileged remote attacker can exhaust server memory through input amplification, rendering the AutoGPT service unavailable to legitimate users.

Affected Products

AutoGPT (Significant-Gravitas/AutoGPT) versions prior to 0.6.32
The ExtractTextInformationBlock block within the AutoGPT platform
AutoGPT agent workflows that expose the affected block to user input

Discovery Timeline

2026-06-26 - CVE-2025-32423 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2025-32423

Vulnerability Analysis

The vulnerability affects the ExtractTextInformationBlock component of AutoGPT. This block processes text input and produces expanded output structures without enforcing an upper bound on memory allocation. Attackers exploit this behavior by submitting compact input that is expanded server-side into extremely large in-memory representations. The vendor advisory documents an amplification factor of roughly five million to one, where 10KB of input results in about 50GB of memory consumption. The EPSS probability is 0.247% at the 15.83 percentile, indicating limited observed exploitation activity to date.

Root Cause

The root cause is missing input size validation and unbounded resource allocation in ExtractTextInformationBlock, tracked as [CWE-770]. The block does not cap the number of derived elements produced from parsed text, nor does it throttle memory used per request. Any input that triggers combinatorial or repetitive expansion during extraction consumes memory proportional to the parsing output rather than the input size.

Attack Vector

The attack is delivered over the network by an authenticated user with low privileges. The attacker submits a crafted payload to a workflow that invokes ExtractTextInformationBlock. The server begins allocating memory to hold the expanded extraction results. As allocations grow, the AutoGPT process consumes host memory until the operating system terminates the process or the host becomes unresponsive. No user interaction is required beyond the initial request submission.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-pppq-xx2w-7jpq for vendor-provided technical details.

Detection Methods for CVE-2025-32423

Indicators of Compromise

Rapid memory growth of the AutoGPT server process shortly after a request invoking ExtractTextInformationBlock
Out-of-memory (OOM) kills of the AutoGPT process in kernel or container runtime logs
Repeated 5xx errors or connection resets from the AutoGPT API following small-payload requests to text extraction endpoints
Elevated request volume from a single authenticated user targeting workflows that use ExtractTextInformationBlock

Detection Strategies

Alert on AutoGPT process resident set size (RSS) exceeding a defined threshold, such as 80% of container or host memory
Correlate authenticated API requests against the version of AutoGPT deployed; flag any request to ExtractTextInformationBlock on versions earlier than 0.6.32
Baseline normal request-to-memory-allocation ratios and alert on outliers where small requests precede large allocations

Monitoring Recommendations

Monitor container OOM events and Linux oom-killer messages in system journals
Capture per-request memory metrics from the AutoGPT runtime and export them to a centralized observability platform
Track authentication logs to identify users invoking the affected block, particularly from newly created or service accounts

How to Mitigate CVE-2025-32423

Immediate Actions Required

Upgrade AutoGPT to version 0.6.32 or later, which contains the vendor fix
Restrict access to AutoGPT instances so that only trusted authenticated users can submit workflow inputs
Apply per-container memory limits so that a single exhausted process cannot destabilize the host
Review recent workflow execution logs for anomalous invocations of ExtractTextInformationBlock

Patch Information

The vulnerability is fixed in AutoGPT version 0.6.32. See the GitHub Security Advisory GHSA-pppq-xx2w-7jpq for the official vendor advisory and patch reference.

Workarounds

Disable or remove workflows that expose ExtractTextInformationBlock to untrusted input until the patch is applied
Enforce input size limits at an upstream reverse proxy or API gateway to reject payloads that could trigger amplification
Apply resource cgroups or Kubernetes memory limits to the AutoGPT deployment to constrain per-pod memory usage
Rate limit authenticated API requests to reduce the ability of a single account to trigger repeated exhaustion attempts

bash

# Example: constrain AutoGPT container memory in Docker Compose
services:
  autogpt:
    image: significantgravitas/autogpt:0.6.32
    mem_limit: 4g
    memswap_limit: 4g
    restart: on-failure