CVE-2025-8849

LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the service.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/danny-avila/librechat/commit/edf33bedcbb08c33e59df76f06454ed7efd896f9	Patch
https://huntr.com/bounties/e9d9404c-cd19-4226-a580-9cba14b7d7d6	Exploit Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:librechat:librechat:0.7.9:-:*:*:*:*:*:*

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) LibreChat versión 0.7.9 es vulnerable a un ataque de denegación de servicio (DoS) debido a valores de parámetros sin límites en el endpoint '/api/memories'. Los parámetros 'key' y 'value' aceptan entradas arbitrariamente grandes sin una validación adecuada, lo que lleva a un error de puntero nulo en el backend basado en Rust cuando se envían valores excesivamente grandes. Esto resulta en la incapacidad de crear nuevas memorias, lo que afecta la estabilidad del servicio.

Information

Published : 2025-10-31 00:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-8849

Mitre link : CVE-2025-8849

CVE.ORG link : CVE-2025-8849

JSON object : View

Products Affected

librechat

librechat

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2025-8849", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8849", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-31T14:59:52.273037Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@huntr.dev", "affectedData": [{"vendor": "danny-avila", "product": "danny-avila/librechat", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "v0.8.0-rc2", "versionType": "custom"}]}]}], "published": "2025-10-31T00:15:37.480", "references": [{"url": "https://github.com/danny-avila/librechat/commit/edf33bedcbb08c33e59df76f06454ed7efd896f9", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/e9d9404c-cd19-4226-a580-9cba14b7d7d6", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the service."}, {"lang": "es", "value": "LibreChat versi\u00f3n 0.7.9 es vulnerable a un ataque de denegaci\u00f3n de servicio (DoS) debido a valores de par\u00e1metros sin l\u00edmites en el endpoint '/api/memories'. Los par\u00e1metros 'key' y 'value' aceptan entradas arbitrariamente grandes sin una validaci\u00f3n adecuada, lo que lleva a un error de puntero nulo en el backend basado en Rust cuando se env\u00edan valores excesivamente grandes. Esto resulta en la incapacidad de crear nuevas memorias, lo que afecta la estabilidad del servicio."}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:0.7.9:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74A99A2E-023B-4C39-9696-61DA01C9284E"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}