CVE-2024-8984

Denial of Service (DoS) in berriai/litellm

HIGH 7.5

En bref

Source: NVD
EPSS: EPSS 0.86 % · centile 58 (2026-10-28)
État: PUBLISHED
Publiée: 2025-03-20 10:09 UTC
Mise à jour: 2025-10-15 12:49 UTC
Attribuée par: @huntr_ai
Statut NVD: Modified

Description

A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.

Faiblesses (CWE)

CWE-770 — Allocation de ressources sans limite ni régulation

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.0	HIGH 7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	@huntr_ai
CVSS 3.0	HIGH 7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · security@huntr.dev (Secondary)

Avis

GHSA-fh2c-86xm-pm2x — LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
PYSEC-2026-1545 — LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

Références européennes

ENISA EUVD · EUVD-2025-6882
GCVE · GCVE-0-2024-8984

Configurations affectées (CPE NVD)

cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:* < 1.65.4
cpe:2.3:a:litellm:litellm:1.65.4:dev2:*:*:*:*:*:*
cpe:2.3:a:litellm:litellm:1.65.4:dev6:*:*:*:*:*:*
cpe:2.3:a:litellm:litellm:1.65.4:dev8:*:*:*:*:*:*
cpe:2.3:a:litellm:litellm:1.65.4:nightly:*:*:*:*:*:*

Produits affectés

Produit	Versions
berriai · berriai/litellm	affected unspecified < v1.65.4-stable

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD