CVE-2024-11173 json
Unhandled Exception in danny-avila/librechat
published 2025-03-20 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-7021
- cvss
- 6.5
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception. Although a valid JWT is required to exploit this vulnerability, LibreChat allows open registration, enabling unauthenticated attackers to create an account and perform the attack. The issue is fixed in version 0.7.6.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/4cebf926-c17f-4836-868b-e1de86221cec referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- danny-avila danny-avila/librechat
Classification
- Weakness
-
- CWE-248 Uncaught Exception
References
-
github.com
/danny-avila/librechat/commit/95a212534f1c5991bd1231a34ac3668b4b592cc3
patch
-
huntr.com
/bounties/4cebf926-c17f-4836-868b-e1de86221cec
exploit, third-party-advisory
Sources
- CVE List CVE-2024-11173
- NVD CVE-2024-11173
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.