CVE-2024-12387: Improper Input Validation in binary-husky/gpt_academic

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-20 · updated 2026-06-17
Weakness: CWE-409

Description

A vulnerability in the binary-husky/gpt_academic repository, as of commit git 3890467, allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This issue arises due to improper input validation when handling compressed file uploads.

Affected products

binary-husky/gpt_academic: 2024-10-15

References

https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4
https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4

Get alerted when CVE-2024-12387 or the next vulnerability affects your stack