CVE-2024-11173: Unhandled Exception in danny-avila/librechat
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception. Although a valid JWT is required to exploit this vulnerability, LibreChat allows open registration, enabling unauthenticated attackers to create an account and perform the attack. The issue is fixed in version 0.7.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11173?
CVE-2024-11173 is classified as a high severity vulnerability due to its potential to cause a full denial of service.
What causes the CVE-2024-11173 vulnerability?
CVE-2024-11173 is caused by an unhandled exception when certain API endpoints receive malformed input.
How do I fix CVE-2024-11173?
To fix CVE-2024-11173, ensure proper input validation and error handling for API endpoints in versions up to 0.7.6 of LibreChat.
Which versions of LibreChat are affected by CVE-2024-11173?
CVE-2024-11173 affects versions of LibreChat up to but not including 0.7.6.
What are the potential impacts of CVE-2024-11173?
The impact of CVE-2024-11173 can lead to server crashes and a denial of service for users interacting with the affected API.