CVE-2024-6038

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the filter_history function within the utils.py module. This function takes a user-provided keyword and attempts to match it against chat history filenames using a regular expression search. Due to the lack of sanitization or validation of the keyword parameter, an attacker can inject a specially crafted regular expression, leading to a denial of service condition. This can cause severe degradation of service performance and potential system unavailability.

• CWE-1333
• CWE-1333

• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/fcdd5fd6b05ef537a1db185ab115758d87e1ba3f
• https://huntr.com/bounties/d41cca0a-82bc-4cbf-a52a-928d304fb42dExploit, Third Party Advisory
• https://huntr.com/bounties/d41cca0a-82bc-4cbf-a52a-928d304fb42dExploit, Third Party Advisory

Published

Jun 27, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6031Tesla Model S oFono AT Command Heap-based Buffer Overflow Co…7.8
• CVE-2024-6032Tesla Model S Iris Modem ql_atfwd Command Injection Code Exe…7.8
• CVE-2024-6033The Event Manager, Events Calendar, Tickets, Registrations –…4.3
• CVE-2024-6035A Stored Cross-Site Scripting (XSS) vulnerability exists in …6.1
• CVE-2024-6036A vulnerability in gaizhenbiao/chuanhuchatgpt version 202404…9.1
• CVE-2024-6037A vulnerability in gaizhenbiao/chuanhuchatgpt version 202404…9.1
• CVE-2024-6039A vulnerability, which was classified as critical, was found…8.8
• CVE-2024-6040In parisneo/lollms-webui version v9.8, the lollms_binding_in…8.8
• CVE-2024-6041A vulnerability was found in itsourcecode Gym Management Sys…8.8
• CVE-2024-6042A vulnerability was found in itsourcecode Real Estate Manage…9.8
• CVE-2024-6043A vulnerability classified as critical has been found in Sou…9.8
• CVE-2024-6044Certain models of D-Link wireless routers have a path traver…6.5