PT-2025-12103 · Danny Avila · Librechat

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-11173

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions danny-avila/librechat versions prior to 0.7.6

Description The issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception, which can cause the server to crash and lead to a full denial of service. Although a valid JWT is required to exploit this issue, LibreChat allows open registration, enabling unauthenticated attackers to create an account and perform the attack.

Recommendations For versions prior to 0.7.6, update to version 0.7.6 to resolve the issue. As a temporary workaround, consider restricting access to the API endpoints that receive malformed input until the issue is resolved.

Exploit

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2024-11173

Affected Products

Librechat

References · 5

• 🔥 https://huntr.com/bounties/4cebf926-c17f-4836-868b-e1de86221cec · Exploit
• https://github.com/danny-avila/librechat/commit/95a212534f1c5991bd1231a34ac3668b4b592cc3 · Patch
• https://osv.dev/vulnerability/CVE-2024-11173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11173 · Security Note
• https://twitter.com/CVEnew/status/1902671100540277233 · Twitter Post