PT-2025-12256 · Unknown · Berriai/Litellm

Published 2025-03-20 · Updated 2025-07-15 · CVE-2024-8984

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions berriai/litellm version v1.44.5

Description A Denial of Service (DoS) vulnerability exists. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.

Recommendations For berriai/litellm version v1.44.5, ensure that input validation is implemented to properly handle multipart boundary strings and prevent the addition of extraneous characters.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2024-8984

GHSA-FH2C-86XM-PM2X

Affected Products

Berriai/Litellm

References · 10

• 🔥 https://huntr.com/bounties/554fc76b-3097-4223-b4cf-110b853e9355 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8984 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8984 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fh2c-86xm-pm2x · Vendor Advisory
• https://github.com/BerriAI/litellm · Note
• https://github.com/berriai/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61 · Note
• https://github.com/BerriAI/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61 · Note
• https://github.com/BerriAI/litellm/blob/8c5ff150f6142608ffe968e4e68429f978fda187/litellm/tests/test_spend_logs.py#L242 · Note
• https://t.me/cvenotify/129036 · Telegram Post
• https://twitter.com/CVEnew/status/1903016828802052424 · Twitter Post