DB-GPTGHSA-6xgj-c5fx-5v57
DB-GPT Uncontrolled Resource Consumption vulnerability
High7.5CVE-2024-10829 · Published Mar 20, 2025 · updated Jul 7, 2026
A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and complete denial of service for all users. This vulnerability affects all endpoints processing multipart/form-data requests.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| dbgpt PyPI | <= 0.6.0 | No fix yet |
Details and references
More DB-GPT advisories
All DB-GPT| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | DB-GPT vulnerable to Cross-Site Request Forgery High7.1Mar 20, 2025 | High7.1 | No fix yet |
| Mar 202025 | DB-GPT vulnerable to Arbitrary File Upload with Path TraversalCritical9.1Mar 20, 2025 | Critical9.1 | No fix yet |
| Mar 202025 | DB-GPT Arbitrary File Write vulnerabilityCritical9.1Mar 20, 2025 | Critical9.1 | No fix yet |
| Mar 202025 | DB-GPT Path Traversal vulnerabilityHigh8.2Mar 20, 2025 | High8.2 | No fix yet |
| Mar 202025 | DB-GPT Absolute Path Traversal vulnerabilityCritical9.1Mar 20, 2025 | Critical9.1 | No fix yet |
| Mar 202025 | DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/uploadCritical9.1Mar 20, 2025 | Critical9.1 | 0.6.2 |