QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2024-6038

Back to search

CVE-2024-6038

Published: Jun 27, 2024

Modified: Oct 15, 2025

PUBLISHED

CVSS v3.0

7.5

HIGH

Description

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the filter_history function within the utils.py module. This function takes a user-provided keyword and attempts to match it against chat history filenames using a regular expression search. Due to the lack of sanitization or validation of the keyword parameter, an attacker can inject a specially crafted regular expression, leading to a denial of service condition. This can cause severe degradation of service performance and potential system unavailability.

VendorProductVersions

gaizhenbiao

gaizhenbiao/chuanhuchatgpt

affected
unspecified - < 20240918

Weaknesses (CWE)

CWE-1333

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now