The vulnerability resides in the getJailbreak endpoint of the backend.py module of the freegpt-webui's Jailbreak Mode. When invoked with crafted input, the function allocates system resources without adequate controls, potentially leading to exhaustion of memory, CPU, or other resources. This class of flaw aligns with CWE-400 and CWE-770, whereby an attacker can trigger a denial of service by forcing the application to consume excessive resources. The exploit is remote and has been published, so attackers can trigger it over the network without local access.

Vendor: ramon-victor. Product: freegpt-webui. The issue appears in all releases up through the commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc, but the maintainer no longer supports these releases. No specific version numbers are available, yet any installation of the product that has not been upgraded to a later, unsupported‑release‑free commit is affected. The product uses a rolling release model, therefore newer patched releases, if available, are not yet catalogued.

The CVSS base score of 6.9 classifies the vulnerability as medium; the EPSS score is not available, and it is not listed in CISA's KEV catalog, indicating a moderate but not widely exploited risk. A remote attacker can trigger the flaw simply by sending requests to the getJailbreak endpoint, with no authentication required. Because the exploit has already been published, there is an operational risk that attackers can automate the abuse; the lack of a vendor patch means the risk persists unless mitigated by configuration or operational changes.