CVE-2025-8849: Denial of Service in danny-avila/librechat

Published Oct 30, 2025

Updated

LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the /api/memories endpoint. The key and value parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the service.

Affected Software

2 affected components

danny-avila librechat

librechat librechat=0.7.9

Remediation

Patch Available

https://github.com/danny-avila/librechat/commit/edf33bedcbb08c33e59df76f06454ed7efd896f9

Event History

Oct 30, 2025

CVE Published

via MITRE·11:42 PM

Data Sourced

via MITRE·11:42 PM

DescriptionSeverityWeakness

Oct 31, 2025

Data Sourced

via NVD·12:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Dec 4, 57887

Event

via FIRST·03:40 PM

Frequently Asked Questions

What is the severity of CVE-2025-8849?

CVE-2025-8849 is classified as a Denial of Service (DoS) vulnerability.

How do I fix CVE-2025-8849?

To fix CVE-2025-8849, implement input validation to restrict the size of the 'key' and 'value' parameters in the /api/memories endpoint.

Which version of LibreChat is affected by CVE-2025-8849?

LibreChat version 0.7.9 is affected by CVE-2025-8849.

What type of attack can be executed due to CVE-2025-8849?

CVE-2025-8849 can be exploited to perform a Denial of Service attack.

What causes the vulnerability in CVE-2025-8849?

The vulnerability in CVE-2025-8849 is caused by the lack of proper validation for unbounded parameters in the API.