CVE-2024-12387 Improper Input Validation in binary-husky/gpt_academic

What is CVE-2024-12387?

CVE-2024-12387 is a medium-severity denial of service vulnerability in binary-husky/gpt_academic, published on 20 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the binary-husky/gpt_academic repository, as of commit git 3890467, allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This issue arises due to improper input validation when handling compressed file uploads.

Weakness: CWE-409

Which versions are affected by CVE-2024-12387?

It affects 1 product.

Products include Binary-Husky Gpt Academic.

How do I fix CVE-2024-12387?

No fix has been published for CVE-2024-12387 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-12387 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12387 exists.

Other vulnerabilities in binary-husky/gpt_academic

• CVE-2026-0763 GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability Critical 9.8
• CVE-2026-0764 GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability Critical 9.8
• CVE-2024-31224 GPT Academic: Pickle deserializing cookies may pose RCE risk Critical 9.8
• CVE-2024-10950 Code Injection in binary-husky/gpt_academic High 8.8
• CVE-2024-10954 Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim` High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4cxc-r29p-3327.