Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-11171Improper Input Validation in danny-avila/librechat

High 7.5

In plain English

A high-severity resource allocation without limits in danny-avila/librechat from danny-avila. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)0.5%top 54.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage (the default setting for multer), there is no limit on the upload file size. This can lead to a server crash due to out-of-memory errors when handling large files. An attacker without any privileges can exploit this vulnerability to cause a complete denial of service. The issue is fixed in version 0.7.6.

Affected products (as reported)

Vendor	Product	Versions
danny-avila	danny-avila/librechat	unspecified – before 0.7.6

Weakness: CWE-770 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In plain English

Official description

Affected products (as reported)

References