Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-10650Denial of Service (DoS) in gaizhenbiao/chuanhuchatgpt
High 7.5
In plain English
A high-severity resource allocation without limits in gaizhenbiao/chuanhuchatgpt from gaizhenbiao. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multipart boundary. Although a patch was applied for CVE-2024-7807, the issue can still be exploited by sending data in groups with 10 characters in a line, with multiple lines. This can cause the system to continuously process these characters, resulting in prolonged unavailability of the service. The exploitation now requires low privilege if authentication is enabled due to a version upgrade in Gradio.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | chuanhuchatgpt | no fix listed | PYSEC-2025-92 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| gaizhenbiao | gaizhenbiao/chuanhuchatgpt | unspecified – through latest |
Weakness: CWE-770 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H