Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-8984Denial of Service (DoS) in berriai/litellm
High 7.5
In plain English
A high-severity resource allocation without limits in berriai/litellm from berriai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | litellm | 1.56.2 | GHSA-fh2c-86xm-pm2x |
| PyPI | litellm | 1.56.2 | PYSEC-2026-1545 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| berriai | berriai/litellm | unspecified – before v1.65.4-stable |
Weakness: CWE-770 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H