# CVE-2025-32424: Significant-Gravitas AutoGPT DoS via disk exhaustion in ScreenshotWebPageBlock

Source: https://junglewise.ai/threats/cve-2025-32424-significant-gravitas-autogpt-dos-via-disk-exhaustion-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2025-32424 · Severity: info · CVSS 8.7 · Published 2026-06-18

AutoGPT, a platform for managing AI agents, is vulnerable to a denial-of-service attack that can crash the system. By repeatedly requesting screenshots of numerous web pages, a malicious user can fill up the server's disk space because the system does not limit how many images are stored or how many times the process can loop. This can lead to a total service outage, preventing the platform from functioning for all users.

Technologies: [Significant-Gravitas AutoGPT](https://junglewise.ai/threats/technologies/autogpt). Vendors: [Significant-Gravitas](https://junglewise.ai/threats/vendors/significant-gravitas).

## Quick answers

**Is CVE-2025-32424 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-32424 being exploited in the wild.

**How severe is CVE-2025-32424?** Informational severity, with a CVSS score of 8.7, published 18 June 2026.

**Which products and versions are affected?** Significant-Gravitas AutoGPT < 0.6.63.

**Is there a fix for CVE-2025-32424?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-32424 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-32424?** Check whether you run Significant-Gravitas AutoGPT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in AutoGPT due to uncontrolled resource consumption (CWE-400). The `ScreenshotWebPageBlock` stores captured screenshots in a temporary directory without enforcing disk space quotas, while the `StepThroughItemsBlock` allows for infinite iterations of these capture tasks. An attacker can exploit this by providing a large list of URLs to screenshot, eventually exhausting the host's disk space. Furthermore, because agents can be configured with long-running timers, the temporary files may not be cleared for an extended period, leading to a persistent DoS state. The issue is resolved in version 0.6.63.

## Affected products

- Significant-Gravitas AutoGPT < 0.6.63

## Timeline

- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: CVE published to NVD

## References

- [https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-7g34-7fvq-xxq6](https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-7g34-7fvq-xxq6)

## Related threats

- [Significant-Gravitas AutoGPT IDOR in webhook ping endpoint](https://junglewise.ai/threats/cve-2026-56823-significant-gravitas-autogpt-idor-in-webhook-ping-endpoint)
- [Significant-Gravitas AutoGPT SSRF bypass in SendWebRequestBlock](https://junglewise.ai/threats/cve-2026-56663-significant-gravitas-autogpt-ssrf-bypass-in-sendwebrequestblock)
- [Significant-Gravitas AutoGPT DoS in ExtractTextInformationBlock](https://junglewise.ai/threats/cve-2025-32423-significant-gravitas-autogpt-dos-in-extracttextinformationblock)
- [Significant-Gravitas AutoGPT DoS in AITextSummarizerBlock](https://junglewise.ai/threats/cve-2025-32394-significant-gravitas-autogpt-dos-in-aitextsummarizerblock)
- [Significant-Gravitas AutoGPT DoS in Fill Text Template block](https://junglewise.ai/threats/cve-2026-33235-significant-gravitas-autogpt-dos-in-fill-text-template-block)