CVE-2024-12387

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability in the binary-husky/gpt_academic repository, as of commit git 3890467, allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This issue arises due to improper input validation when handling compressed file uploads.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-409

Affected software

Vendor	Product	Versions
binary-husky	binary-husky/gpt_academic	>= unspecified, <= latest

References

https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4Exploit, Third Party Advisory
https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4Exploit, Third Party Advisory

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-123886.5A vulnerability in binary-husky/gpt_academic version 310122f allows for a Regular Expression Denial of Service (ReDoS) attack. The applicati CVE-2024-123898.8A path traversal vulnerability exists in binary-husky/gpt_academic version git 310122f. The application supports the extraction of user-prov CVE-2024-12395.4The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blog post read more button in all CVE-2024-123908.8A vulnerability in binary-husky/gpt_academic version git 310122f allows for remote code execution. The application supports the extraction o CVE-2024-123916.5A vulnerability in binary-husky/gpt_academic, as of commit 310122f, allows for a Regular Expression Denial of Service (ReDoS) attack. The fu CVE-2024-123926.5A Server-Side Request Forgery (SSRF) vulnerability exists in binary-husky/gpt_academic version git 310122f. The application has a functional CVE-2024-123935.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site S CVE-2024-123946.1The Action Network plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and CVE-2024-123956.1The WooCommerce Additional Fees On Checkout (Free) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ par CVE-2024-123977.4A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue CVE-2024-123988.8An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) an CVE-2024-123997.1CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause part