CVE-2024-8984

Denial of Service (DoS) in berriai/litellm

HIGH 7.5

At a glance

Source: NVD
EPSS: EPSS 0.86 % · percentile 58 (2026-10-28)
State: PUBLISHED
Published: 2025-03-20 10:09 UTC
Updated: 2025-10-15 12:49 UTC
Assigner: @huntr_ai
NVD status: Modified

Description

A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.

Weaknesses (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

Scores

Version	Score	Vector	Scored by
CVSS 3.0	HIGH 7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	@huntr_ai
CVSS 3.0	HIGH 7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · security@huntr.dev (Secondary)

Advisories

GHSA-fh2c-86xm-pm2x — LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
PYSEC-2026-1545 — LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

European references

ENISA EUVD · EUVD-2025-6882
GCVE · GCVE-0-2024-8984

Affected configurations (NVD CPE)

cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:* < 1.65.4
cpe:2.3:a:litellm:litellm:1.65.4:dev2:*:*:*:*:*:*
cpe:2.3:a:litellm:litellm:1.65.4:dev6:*:*:*:*:*:*
cpe:2.3:a:litellm:litellm:1.65.4:dev8:*:*:*:*:*:*
cpe:2.3:a:litellm:litellm:1.65.4:nightly:*:*:*:*:*:*

Affected products

Product	Versions
berriai · berriai/litellm	affected unspecified < v1.65.4-stable

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD