# CVE-2025-32423: Significant-Gravitas AutoGPT DoS in ExtractTextInformationBlock

Source: https://junglewise.ai/threats/cve-2025-32423-significant-gravitas-autogpt-dos-in-extracttextinformationblock  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2025-32423 · Severity: info · CVSS 5.3 · Published 2026-06-26

AutoGPT is a platform used to create and manage autonomous AI agents. A flaw in how the system processes text allows a user to provide a small amount of data that causes the server to consume massive amounts of memory. This can lead to a complete system crash or service outage, preventing legitimate users from accessing the platform.

Technologies: [Significant-Gravitas AutoGPT](https://junglewise.ai/threats/technologies/autogpt). Vendors: [Significant-Gravitas](https://junglewise.ai/threats/vendors/significant-gravitas).

## Quick answers

**Is CVE-2025-32423 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-32423 being exploited in the wild.

**How severe is CVE-2025-32423?** Informational severity, with a CVSS score of 5.3, published 26 June 2026.

**Which products and versions are affected?** Significant-Gravitas AutoGPT < 0.6.32.

**Is there a fix for CVE-2025-32423?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-32423 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-32423?** Check whether you run Significant-Gravitas AutoGPT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service (DoS) vulnerability exists in the ExtractTextInformationBlock component of AutoGPT due to improper resource allocation (CWE-770). The vulnerability stems from the use of user-controlled regular expressions and input text in the `re.finditer` function within `text.py`. Specifically, an attacker can provide a lookahead pattern like "(?=(.+))" which results in O(n^2) output growth relative to the input size. For example, a 10KB input can result in 50GB of memory consumption. This allows an authenticated user to exhaust server memory resources. The issue is fixed in version 0.6.32.

## Affected products

- Significant-Gravitas AutoGPT < 0.6.32

## Timeline

- 2026-06-23: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD

## References

- [https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-pppq-xx2w-7jpq](https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-pppq-xx2w-7jpq)

## Related threats

- [Significant-Gravitas AutoGPT IDOR in webhook ping endpoint](https://junglewise.ai/threats/cve-2026-56823-significant-gravitas-autogpt-idor-in-webhook-ping-endpoint)
- [Significant-Gravitas AutoGPT SSRF bypass in SendWebRequestBlock](https://junglewise.ai/threats/cve-2026-56663-significant-gravitas-autogpt-ssrf-bypass-in-sendwebrequestblock)
- [Significant-Gravitas AutoGPT DoS in AITextSummarizerBlock](https://junglewise.ai/threats/cve-2025-32394-significant-gravitas-autogpt-dos-in-aitextsummarizerblock)
- [Significant-Gravitas AutoGPT DoS in Fill Text Template block](https://junglewise.ai/threats/cve-2026-33235-significant-gravitas-autogpt-dos-in-fill-text-template-block)
- [Significant-Gravitas AutoGPT DOM-based XSS in signup page](https://junglewise.ai/threats/cve-2026-55237-significant-gravitas-autogpt-dom-based-xss-in-signup-page)