CVE-2024-8984 json
Denial of Service (DoS) in berriai/litellm
published 2025-03-20 19 mo ago modified 2026-09-10 1 mo ago also GHSA-fh2c-86xm-pm2x , PYSEC-2026-1545 , EUVD-2025-6882
- cvss
- 7.5
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.
Patch / fix
- pypi litellm 1.56.2
- berriai berriai/litellm v1.65.4-stable
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/554fc76b-3097-4223-b4cf-110b853e9355 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | litellm | <1.56.2 |
1.56.2 |
Affected products
- berriai berriai/litellm
Classification
References
- github.com /berriai/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61
-
github.com
/BerriAI/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61
web
-
huntr.com
/bounties/554fc76b-3097-4223-b4cf-110b853e9355
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-8984
advisory
-
github.com
/BerriAI/litellm
package
-
github.com
/BerriAI/litellm/blob/8c5ff150f6142608ffe968e4e68429f978fda187/litellm/tests/test_spend_logs.py#L242
web
-
pypi.org
/project/litellm
package
-
github.com
/advisories/GHSA-fh2c-86xm-pm2x
advisory
Sources
- CVE List CVE-2024-8984
- GitHub Advisory GHSA-fh2c-86xm-pm2x
- NVD CVE-2024-8984
- OSV PYSEC-2026-1545
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.