CVE-2026-54037

Katalog CVE

CVSS 6.5 · Medium EPSS 0,51%

Kerentanan Allocation of Resources Without Limits or Throttling pada librechat. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-7105 added forkIpLimiter and forkUserLimiter rate limiters to POST /api/convos/fork to prevent rapid-fire conversation duplication. However, the POST /api/convos/duplicate endpoint — which is in the same file and performs the exact same expensive database operations — was not given any rate limiter. An authenticated user can bypass the CVE-2025-7105 fix by using /duplicate instead of /fork to exhaust server resources. This vulnerability is fixed in 0.8.4-rc1.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

29 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 42,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-g445-9wq6-jf3v exploit · advisory vendor