CVE-2024-11172

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-11172
A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This issue is fixed in version 0.7.6.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/danny-avila/librechat/commit/976784c01fa4cce00d4c2941801d56aed375c21b Patch
https://huntr.com/bounties/c76a7ee3-2e26-45a0-8940-21c749592105 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*
History

15 Oct 2025, 13:15

Type Values Removed Values Added
CWE CWE-400 CWE-248

15 Jul 2025, 16:44

Type Values Removed Values Added
First Time Librechat
Librechat librechat
CPE cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*
References () https://github.com/danny-avila/librechat/commit/976784c01fa4cce00d4c2941801d56aed375c21b - () https://github.com/danny-avila/librechat/commit/976784c01fa4cce00d4c2941801d56aed375c21b - Patch
References () https://huntr.com/bounties/c76a7ee3-2e26-45a0-8940-21c749592105 - () https://huntr.com/bounties/c76a7ee3-2e26-45a0-8940-21c749592105 - Exploit, Third Party Advisory
Summary
  • (es) Una vulnerabilidad en la versión git a1647d7 de danny-avila/librechat permite a un atacante no autenticado provocar una denegación de servicio mediante el envío de un payload manipulado al servidor. El middleware `checkBan` no está rodeado por un bloque try-catch, y una excepción no controlada provocará el bloqueo del servidor. Este problema se ha corregido en la versión 0.7.6.

20 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-20 10:15

Updated : 2025-10-15 13:15

NVD link : CVE-2024-11172

Mitre link : CVE-2024-11172

CVE.ORG link : CVE-2024-11172

JSON object : View

Products Affected

librechat

  • librechat
CWE
CWE-248

Uncaught Exception