Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-9437Unauthenticated Denial of Service in transformeroptimus/superagi

High 7.5

In plain English

A high-severity resource allocation without limits in transformeroptimus/superagi from transformeroptimus. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)0.8%top 42.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service (DoS) attack. The vulnerability exists in the resource upload request, where appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request causes the server to continuously process each character. This leads to excessive resource consumption and renders the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.

Affected products (as reported)

Vendor	Product	Versions
transformeroptimus	transformeroptimus/superagi	unspecified – through latest

Weakness: CWE-770 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://huntr.com/bounties/27404e9c-eb3d-4626-a9d9-8dc1b3295ce0