# CVE-2025-32394: Significant-Gravitas AutoGPT DoS in AITextSummarizerBlock

Source: https://junglewise.ai/threats/cve-2025-32394-significant-gravitas-autogpt-dos-in-aitextsummarizerblock  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2025-32394 · Severity: info · CVSS 5.3 · Published 2026-06-26

AutoGPT, a platform for managing AI agents, contains a flaw that allows users to crash the service. By providing a small amount of specially crafted text, an attacker can force the server to consume massive amounts of memory (e.g., 10KB of input resulting in 50GB of memory usage). This leads to a denial-of-service, making the platform unavailable for all users.

Technologies: [Significant-Gravitas AutoGPT](https://junglewise.ai/threats/technologies/autogpt). Vendors: [Significant-Gravitas](https://junglewise.ai/threats/vendors/significant-gravitas).

## Quick answers

**Is CVE-2025-32394 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-32394 being exploited in the wild.

**How severe is CVE-2025-32394?** Informational severity, with a CVSS score of 5.3, published 26 June 2026.

**Which products and versions are affected?** Significant-Gravitas AutoGPT < 0.6.32.

**Is there a fix for CVE-2025-32394?** A patch was published on 2026-06-32: Vulnerability fixed in version 0.6.32 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-32394 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-32394?** Check whether you run Significant-Gravitas AutoGPT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability exists in the `AITextSummarizerBlock` of AutoGPT due to improper handling of text chunking in `llm.py`. The `_split_text` function uses user-controllable parameters (`max_tokens` and `overlap`) to determine how text is segmented. By setting `overlap` to `max_tokens - 1`, an attacker can force the `chunk_size` to 1, causing the loop to execute for every word in the input and append overlapping segments to a list. This results in quadratic memory growth; for instance, a 10KB input can trigger 50GB of memory consumption. The vulnerability is tracked as CWE-405 and CWE-770 and is fixed in version 0.6.32.

## Affected products

- Significant-Gravitas AutoGPT (autogpt-platform-beta) < 0.6.32

## Timeline

- 2026-06-23: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-32: patched: Vulnerability fixed in version 0.6.32

## References

- [https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-955p-gpfx-r66j](https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-955p-gpfx-r66j)

## Related threats

- [Significant-Gravitas AutoGPT IDOR in webhook ping endpoint](https://junglewise.ai/threats/cve-2026-56823-significant-gravitas-autogpt-idor-in-webhook-ping-endpoint)
- [Significant-Gravitas AutoGPT SSRF bypass in SendWebRequestBlock](https://junglewise.ai/threats/cve-2026-56663-significant-gravitas-autogpt-ssrf-bypass-in-sendwebrequestblock)
- [Significant-Gravitas AutoGPT DoS in ExtractTextInformationBlock](https://junglewise.ai/threats/cve-2025-32423-significant-gravitas-autogpt-dos-in-extracttextinformationblock)
- [Significant-Gravitas AutoGPT DoS in Fill Text Template block](https://junglewise.ai/threats/cve-2026-33235-significant-gravitas-autogpt-dos-in-fill-text-template-block)
- [Significant-Gravitas AutoGPT DOM-based XSS in signup page](https://junglewise.ai/threats/cve-2026-55237-significant-gravitas-autogpt-dom-based-xss-in-signup-page)