CVE-2025-8849

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8849", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2025-08-10T18:16:35.321Z", "datePublished": "2025-10-30T23:42:41.552Z", "dateUpdated": "2025-10-31T15:09:34.057Z"}, "containers": {"cna": {"title": "Denial of Service in danny-avila/librechat", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2025-10-30T23:42:41.552Z"}, "descriptions": [{"lang": "en", "value": "LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the service."}], "affected": [{"vendor": "danny-avila", "product": "danny-avila/librechat", "versions": [{"version": "unspecified", "lessThan": "v0.8.0-rc2", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/e9d9404c-cd19-4226-a580-9cba14b7d7d6"}, {"url": "https://github.com/danny-avila/librechat/commit/edf33bedcbb08c33e59df76f06454ed7efd896f9"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption", "cweId": "CWE-400"}]}], "source": {"advisory": "e9d9404c-cd19-4226-a580-9cba14b7d7d6", "discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-31T14:59:52.273037Z", "id": "CVE-2025-8849", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T15:09:34.057Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8849", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-31T14:59:52.273037Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T15:00:02.570Z"}}], "cna": {"title": "Denial of Service in danny-avila/librechat", "source": {"advisory": "e9d9404c-cd19-4226-a580-9cba14b7d7d6", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "danny-avila", "product": "danny-avila/librechat", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "v0.8.0-rc2", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/e9d9404c-cd19-4226-a580-9cba14b7d7d6"}, {"url": "https://github.com/danny-avila/librechat/commit/edf33bedcbb08c33e59df76f06454ed7efd896f9"}], "descriptions": [{"lang": "en", "value": "LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2025-10-30T23:42:41.552Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8849", "state": "PUBLISHED", "dateUpdated": "2025-10-31T15:09:34.057Z", "dateReserved": "2025-08-10T18:16:35.321Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2025-10-30T23:42:41.552Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "danny-avila/librechat", "vendor": "danny-avila", "versions": [{"lessThan": "v0.8.0-rc2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@huntr.dev"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:0.7.9:-:*:*:*:*:*:*", "matchCriteriaId": "74A99A2E-023B-4C39-9696-61DA01C9284E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the service."}, {"lang": "es", "value": "LibreChat versi\u00f3n 0.7.9 es vulnerable a un ataque de denegaci\u00f3n de servicio (DoS) debido a valores de par\u00e1metros sin l\u00edmites en el endpoint '/api/memories'. Los par\u00e1metros 'key' y 'value' aceptan entradas arbitrariamente grandes sin una validaci\u00f3n adecuada, lo que lleva a un error de puntero nulo en el backend basado en Rust cuando se env\u00edan valores excesivamente grandes. Esto resulta en la incapacidad de crear nuevas memorias, lo que afecta la estabilidad del servicio."}], "id": "CVE-2025-8849", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8849", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-31T14:59:52.273037Z", "version": "2.0.3"}}]}, "published": "2025-10-31T00:15:37.480", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/danny-avila/librechat/commit/edf33bedcbb08c33e59df76f06454ed7efd896f9"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://huntr.com/bounties/e9d9404c-cd19-4226-a580-9cba14b7d7d6"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security@huntr.dev", "type": "Secondary"}]}

{}

{"created": "2025-10-31T10:12:50.095855+00:00", "updated": "2025-10-31T10:12:50.095883+00:00", "vendors": ["librechat", "librechat$PRODUCT$librechat"]}