CVE-2025-32425: Significant-Gravitas AutoGPT disk exhaustion via unbounded logging

CVE-2025-32425 · Severity: medium · CVSS 5.5 · Published 2026-05-13

AutoGPT is a platform used to create and manage autonomous AI agents. A vulnerability in how the system handles activity logs allows the server's storage space to be completely filled up. If an attacker or a high volume of users triggers enough activity, the resulting massive log files can crash the server or prevent it from functioning, leading to a total service outage.

Technologies: Significant-Gravitas AutoGPT. Vendors: Significant-Gravitas.

Quick answers

Is CVE-2025-32425 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-32425 being exploited in the wild.
How severe is CVE-2025-32425?
Medium severity, with a CVSS score of 5.5, published 13 May 2026.
Which products and versions are affected?
Significant-Gravitas AutoGPT <= 0.6.31; Significant-Gravitas Autogpt-Platform-Beta <= 0.6.31.
Is there a fix for CVE-2025-32425?
A patch was published on 2025-10-02: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-32425 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-32425?
Check whether you run Agpt Autogpt Platform, Significant-Gravitas AutoGPT or Significant-Gravitas Autogpt-Platform-Beta at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability exists in AutoGPT prior to version 0.6.32. The application records execution processes to stdout/stderr, which Docker captures as container logs. Because there were no configured limits on log size or rotation in the Docker configuration or the application's logging utility, high volumes of activity can lead to the exhaustion of host disk space. An attacker can exploit this to cause a Denial of Service (DoS) by triggering excessive logging events. The issue was resolved by implementing log rotation limits (10MB x 3 files) at both the Docker and application levels.

Affected products

  • Significant-Gravitas AutoGPT Platform <= 0.6.31

Timeline

  • 2025-10-02: patched: Fix committed to repository
  • 2026-05-11: advisory: GitHub Security Advisory published
  • 2026-05-13: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.