Vulnerability · Published Oct 29, 2024 · Assigned by @huntr_ai

CVE-2024-7807Denial of Service (DOS) in gaizhenbiao/chuanhuchatgpt

High 7.5

In plain English

A high-severity resource allocation without limits in gaizhenbiao/chuanhuchatgpt from gaizhenbiao. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)0.6%top 49.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240628 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process each character, rendering ChuanhuChatGPT inaccessible. This uncontrolled resource consumption can lead to prolonged unavailability of the service, disrupting operations and causing potential data inaccessibility and loss of productivity.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	chuanhuchatgpt	no fix listed	PYSEC-2024-119

Affected products (as reported)

Vendor	Product	Versions
gaizhenbiao	gaizhenbiao/chuanhuchatgpt	unspecified – before 20240918

Weakness: CWE-770 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References