PT-2025-12191 · Mintplex · Anything-Llm

Published 2025-03-20 · Updated 2025-07-15 · CVE-2024-7771

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm version 1d9452da2b92

Description A denial of service issue arises when uploading an audio file with a very low sample rate, causing the site instance to crash. This occurs due to the localWhisper implementation, where resampling the audio file from 1 Hz to 16000 Hz quickly exceeds available memory, leading to the Docker instance being killed by the instance manager.

Recommendations For version 1d9452da2b92, as a temporary workaround, consider restricting the upload of audio files with very low sample rates to prevent the denial of service issue until a patch is available. Additionally, limiting the resources allocated to the Docker instance or implementing memory limits may help mitigate the risk of the instance being killed by the instance manager.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-7771

Affected Products

Anything-Llm

References · 6

• 🔥 https://huntr.com/bounties/a31a9834-e9c4-4b50-a1ec-ecb69f2a6142 · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/dd017c6cbbf42abdef7861a66558c53b66424d07 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-7771 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7771 · Vendor Advisory
• https://t.me/cvenotify/129030 · Telegram Post
• https://twitter.com/CVEnew/status/1903336847046013149 · Twitter Post