CVE-2025-8849

Katalog CVE

CVSS 7.5 · High EPSS 0,35%

Kerentanan Uncontrolled Resource Consumption pada librechat. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the service.

Rincian

Terbit di NVD

31 Oktober 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/danny-avila/librechat/commit/edf33bedcbb08c33e59df76f06454ed7efd896f9 patch
• https://huntr.com/bounties/e9d9404c-cd19-4226-a580-9cba14b7d7d6 exploit · mitigasi · advisory pihak ketiga