PT-2024-10343 · Librechat · Librechat

Published 2024-10-28 · Updated 2025-03-21 · CVE-2024-11172

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibreChat (affected versions not specified)

Description The issue is related to an uncontrolled resource consumption in the checkBan.js script of the LibreChat platform, which is based on artificial intelligence. This could allow a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-248

Related Identifiers

BDU:2025-00834

CVE-2024-11172

Affected Products

Librechat

References · 6

• 🔥 https://huntr.com/bounties/c76a7ee3-2e26-45a0-8940-21c749592105 · Exploit
• https://github.com/danny-avila/librechat/commit/976784c01fa4cce00d4c2941801d56aed375c21b · Patch
• https://osv.dev/vulnerability/CVE-2024-11172 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00834 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-11172 · Security Note
• https://twitter.com/CVEnew/status/1902968839454986743 · Twitter Post