What is CVE-2024-8018?

CVE-2024-8018 is a high-severity vulnerability in Imartinez Imartinez/privategpt, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2025-03-20.

How severe is CVE-2024-8018?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2024-8018 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in Imartinez Imartinez/privategpt

CVE-2024-8018

A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process these characters, rendering privateGPT inaccessible. This uncontrolled resource consumption can lead to prolonged unavailability of the service, disrupting operations and causing potential data inaccessibility and loss of productivity.

EPSS: 0.006 (44.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Imartinez Imartinez/privategpt — versions unspecified
Pribai Privategpt — versions 0.5.0

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-8018?: CVE-2024-8018 is a high-severity vulnerability in Imartinez Imartinez/privategpt, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2025-03-20.
How severe is CVE-2024-8018?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2024-8018 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.