CVE-2024-8984

A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/berriai/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61
https://huntr.com/bounties/554fc76b-3097-4223-b4cf-110b853e9355	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:litellm:litellm::::::::
	cpe:2.3:a:litellm:litellm:1.65.4:dev2::::::
	cpe:2.3:a:litellm:litellm:1.65.4:dev6::::::
	cpe:2.3:a:litellm:litellm:1.65.4:dev8::::::
	cpe:2.3:a:litellm:litellm:1.65.4:nightly::::::

History

No history.

Information

Published : 2025-03-20 10:15

Updated : 2025-10-15 13:15

NVD link : CVE-2024-8984

Mitre link : CVE-2024-8984

CVE.ORG link : CVE-2024-8984

JSON object : View

Products Affected

litellm

litellm

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

NVD-CWE-noinfo

{"id": "CVE-2024-8984", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-03-20T10:15:45.583", "references": [{"url": "https://github.com/berriai/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61", "source": "[email protected]"}, {"url": "https://huntr.com/bounties/554fc76b-3097-4223-b4cf-110b853e9355", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-770"}]}, {"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service."}, {"lang": "es", "value": "Existe una vulnerabilidad de denegaci\u00f3n de servicio (DoS) en berriai/litellm versi\u00f3n v1.44.5. Esta vulnerabilidad puede explotarse a\u00f1adiendo caracteres, como guiones (-), al final de un l\u00edmite multiparte en una solicitud HTTP. El servidor procesa continuamente cada car\u00e1cter, lo que provoca un consumo excesivo de recursos y deja el servicio indisponible. El problema no est\u00e1 autenticado y no requiere la interacci\u00f3n del usuario, lo que afecta a todos los usuarios del servicio."}], "lastModified": "2025-10-15T13:15:56.553", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA751173-C195-4141-990E-BF283359EB51", "versionEndExcluding": "1.65.4"}, {"criteria": "cpe:2.3:a:litellm:litellm:1.65.4:dev2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9FF1A650-6A97-453B-AC95-C05B9864B71C"}, {"criteria": "cpe:2.3:a:litellm:litellm:1.65.4:dev6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5806D436-A882-4E96-B1F6-281BDD797F0F"}, {"criteria": "cpe:2.3:a:litellm:litellm:1.65.4:dev8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00216FEB-389B-4841-AA18-FB29D2CA487A"}, {"criteria": "cpe:2.3:a:litellm:litellm:1.65.4:nightly:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "809B9B6C-FCDA-4BDB-BB3D-AB94E933F042"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}