# CVE-2025-32392: Significant-Gravitas AutoGPT DoS via uncontrolled resource consumption in LoopVideoBlock

Source: https://junglewise.ai/threats/cve-2025-32392-significant-gravitas-autogpt-dos-via-uncontrolled-resource  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2025-32392 · Severity: info · CVSS 8.7 · Published 2026-06-18

AutoGPT, a platform for managing AI agents, contains a flaw in how it processes video files. An attacker can provide a command that forces the system to loop a video an infinite number of times, which quickly fills up the server's disk space. This can crash the service and prevent legitimate users from accessing the platform.

Technologies: [Significant-Gravitas AutoGPT](https://junglewise.ai/threats/technologies/autogpt). Vendors: [Significant-Gravitas](https://junglewise.ai/threats/vendors/significant-gravitas).

## Quick answers

**Is CVE-2025-32392 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-32392 being exploited in the wild.

**How severe is CVE-2025-32392?** Informational severity, with a CVSS score of 8.7, published 18 June 2026.

**Which products and versions are affected?** Significant-Gravitas AutoGPT < 0.6.63.

**Is there a fix for CVE-2025-32392?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-32392 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-32392?** Check whether you run Significant-Gravitas AutoGPT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in AutoGPT's LoopVideoBlock due to uncontrolled resource consumption (CWE-400). The `LoopVideoBlock` component allows users to specify a video file and a number of loops or a duration for processing. However, the application fails to validate or limit the `n_loops` or `duration` parameters. An attacker can provide an extremely high value for these inputs, causing the backend to generate a massive video file that exhausts available disk space. Furthermore, because agent execution can be delayed indefinitely, the resulting disk exhaustion can lead to a persistent DoS state. The issue is fixed in version 0.6.63.

## Affected products

- Significant-Gravitas AutoGPT < 0.6.63

## Timeline

- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: NVD publication date

## References

- [https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-267x-8jx3-gg6w](https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-267x-8jx3-gg6w)

## Related threats

- [Significant-Gravitas AutoGPT IDOR in webhook ping endpoint](https://junglewise.ai/threats/cve-2026-56823-significant-gravitas-autogpt-idor-in-webhook-ping-endpoint)
- [Significant-Gravitas AutoGPT SSRF bypass in SendWebRequestBlock](https://junglewise.ai/threats/cve-2026-56663-significant-gravitas-autogpt-ssrf-bypass-in-sendwebrequestblock)
- [Significant-Gravitas AutoGPT DoS in ExtractTextInformationBlock](https://junglewise.ai/threats/cve-2025-32423-significant-gravitas-autogpt-dos-in-extracttextinformationblock)
- [Significant-Gravitas AutoGPT DoS in AITextSummarizerBlock](https://junglewise.ai/threats/cve-2025-32394-significant-gravitas-autogpt-dos-in-aitextsummarizerblock)
- [Significant-Gravitas AutoGPT DoS in Fill Text Template block](https://junglewise.ai/threats/cve-2026-33235-significant-gravitas-autogpt-dos-in-fill-text-template-block)