PT-2025-12256 · Unknown · Berriai/Litellm

CVE-2024-8984 · Published 2025-03-20 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions berriai/litellm version v1.44.5

Description A Denial of Service (DoS) vulnerability exists. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.

Recommendations For berriai/litellm version v1.44.5, ensure that input validation is implemented to properly handle multipart boundary strings and prevent the addition of extraneous characters.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2024-8984

GHSA-FH2C-86XM-PM2X

PYSEC-2026-1545

Affected Products

Berriai/Litellm

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8984.json · Exploit
• 🔥 https://huntr.com/bounties/554fc76b-3097-4223-b4cf-110b853e9355 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8984 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8984 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1545 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fh2c-86xm-pm2x · Vendor Advisory
• https://github.com/BerriAI/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61 · Note
• https://github.com/BerriAI/litellm/blob/8c5ff150f6142608ffe968e4e68429f978fda187/litellm/tests/test_spend_logs.py#L242 · Note
• https://github.com/BerriAI/litellm · Note
• https://github.com/berriai/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61 · Note
• https://github.com/advisories/GHSA-fh2c-86xm-pm2x · Note
• https://pypi.org/project/litellm · Note
• https://t.me/cvenotify/129036 · Telegram Post
• https://twitter.com/CVEnew/status/1903016828802052424 · Twitter Post