CVE-2024-8984High· 7.5▾ TwilightLiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.8%
Last analysed / modified upstream
0.8% → 0.9%
A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.
litellm < 1.56.2Upgrade to a patched release:
litellm 1.56.2Connected by shared product, vendor, weakness, or advisory.
GHSA-hhww-mrg2-969hMedium· 6.8LiteLLM vulnerable to reflected XSS in /sso/debug/callback
GHSA-g5ff-637f-6q2mHigh· 8.1LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
CVE-2026-114612Critical· 9.9LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
CVE-2026-59823Medium· 5.3LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
CVE-2026-12799Medium· 4.3BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
CVE-2026-12796Medium· 6.3BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens