LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the service.
References
| Link | Resource |
|---|---|
| https://github.com/danny-avila/librechat/commit/edf33bedcbb08c33e59df76f06454ed7efd896f9 | Patch |
| https://huntr.com/bounties/e9d9404c-cd19-4226-a580-9cba14b7d7d6 | Exploit Mitigation Third Party Advisory |
Configurations
History
10 Nov 2025, 17:14
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Librechat librechat
Librechat |
|
| CPE | cpe:2.3:a:librechat:librechat:0.7.9:-:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | () https://github.com/danny-avila/librechat/commit/edf33bedcbb08c33e59df76f06454ed7efd896f9 - Patch | |
| References | () https://huntr.com/bounties/e9d9404c-cd19-4226-a580-9cba14b7d7d6 - Exploit, Mitigation, Third Party Advisory |
31 Oct 2025, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-31 00:15
Updated : 2025-11-10 17:14
NVD link : CVE-2025-8849
Mitre link : CVE-2025-8849
CVE.ORG link : CVE-2025-8849
JSON object : View
Products Affected
librechat
- librechat
CWE
CWE-400
Uncontrolled Resource Consumption