{"id":"CVE-2024-12063","aliases":["EUVD-2025-7026","GHSA-q5v7-7r3x-m7hg"],"status":"published","title":"Denial of Service in imartinez/privategpt","description":"A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00788,"percentile":0.56621,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2025-03-20T10:11:34Z","modified":"2026-10-28T02:30:53Z","products":[{"vendor":"imartinez","product":"imartinez/privategpt"},{"vendor":"pribai","product":"privategpt"}],"references":[{"url":"https://huntr.com/bounties/7db0091f-cb53-4cde-aad7-7ce491dfd8d9","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12063","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q5v7-7r3x-m7hg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12063.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-12063","title":"Denial of Service in imartinez/privategpt","description":"A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users.","status":"published","published":"2025-03-20T10:11:34.263Z","modified":"2025-03-20T13:55:34.718Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:12.287582Z"}],"euvd":[{"id":"EUVD-2025-7026","description":"A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users.","status":"published","published":"2025-03-20T10:11:34Z","modified":"2025-03-20T13:55:34Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:57.796612Z"}],"ghsa":[{"id":"GHSA-q5v7-7r3x-m7hg","title":"A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt...","description":"A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users.","status":"published","published":"2025-03-20T12:32:42Z","modified":"2025-03-20T12:32:50Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:00:22.529672Z"}],"nvd":[{"id":"CVE-2024-12063","description":"A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users.","status":"published","published":"2025-03-20T10:15:26.77Z","modified":"2026-06-17T06:58:58.73Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:10:45.815983Z"}],"osv":[{"id":"CVE-2024-12063","title":"Denial of Service in imartinez/privategpt","description":"A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users.","status":"published","published":"2025-03-20T10:11:34.263Z","modified":"2026-10-28T02:30:53.517091667Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:37.917085Z"}]}}