Executive brief
freegpt-webui is a web application that provides access to GPT models. A race condition in the jailbreak mode feature allows an attacker to send concurrent requests that cause unbounded prompt accumulation, eventually exceeding token limits and causing a denial of service affecting all users. The vulnerability requires high attack complexity and is in an archived, unsupported product.
Technical details
The vulnerability is a CWE-362 race condition (TOCTOU) in the getJailbreak function of server/config.py. The function performs a non-atomic read-modify-write operation (+=) on a global, module-level dictionary (special_instructions) without synchronization. An attacker can send multiple concurrent POST requests with the jailbreak parameter to trigger interleaved reads and writes, causing the prompt instruction content to accumulate on each request. After sufficient iterations, the cumulative instruction text exceeds the upstream model's token limit, resulting in persistent denial of service for all users attempting to use the jailbreak feature. The attack is network-accessible but requires high complexity to exploit reliably.
Affected products
- ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc (rolling release)
Timeline
- 2026-07-18: disclosed: Security advisory published on GitHub gist
- 2026-09-04: advisory: CVE-2026-85704 published on NVD