Executive brief
AutoGPT is a platform used to create and manage autonomous AI agents. A flaw in how the system processes text allows a user to provide a small amount of data that causes the server to consume massive amounts of memory. This can lead to a complete system crash or service outage, preventing legitimate users from accessing the platform.
Technical details
A denial of service (DoS) vulnerability exists in the ExtractTextInformationBlock component of AutoGPT due to improper resource allocation (CWE-770). The vulnerability stems from the use of user-controlled regular expressions and input text in the `re.finditer` function within `text.py`. Specifically, an attacker can provide a lookahead pattern like "(?=(.+))" which results in O(n^2) output growth relative to the input size. For example, a 10KB input can result in 50GB of memory consumption. This allows an authenticated user to exhaust server memory resources. The issue is fixed in version 0.6.32.
Affected products
- Significant-Gravitas AutoGPT < 0.6.32
Timeline
- 2026-06-23: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD