CVE-2024-7771— Denial of Service in mintplex-labs/anything-llm
Quick assessment
Affected
mintplex-labs mintplex-labs/anything-llm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
anything-llm是Mintplex开源的一个一体式桌面和 Docker AI 应用程序。 anything-llm存在资源管理错误漏洞，该漏洞源于上传低采样率音频文件可能导致站点实例崩溃。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-7771
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial of Service in mintplex-labs/anything-llm
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the Dockerized version of mintplex-labs/anything-llm (latest, digest 1d9452da2b92) allows for a denial of service. Uploading an audio file with a very low sample rate causes the functionality responsible for transcribing it to crash the entire site instance. The issue arises from the localWhisper implementation, where resampling the audio file from 1 Hz to 16000 Hz quickly exceeds available memory, leading to the Docker instance being killed by the instance manager.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
anything-llm 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
anything-llm是Mintplex开源的一个一体式桌面和 Docker AI 应用程序。 anything-llm存在资源管理错误漏洞，该漏洞源于上传低采样率音频文件可能导致站点实例崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified ~ 1.3.1 | - |
|
II. Public POCs for CVE-2024-7771
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-7771
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-7771 (1)
Vendor Advisories for CVE-2024-7771 (1)
Same Patch Batch · mintplex-labs · 2025-03-20 · 9 CVEs total
| CVE-2024-6842 | Exposure of Sensitive Information in mintplex-labs/anything-llm | |
| CVE-2024-13060 | Improper Authorization in mintplex-labs/anything-llm | |
| CVE-2024-8196 | Missing Authentication for Critical Function in mintplex-labs/anything-llm | |
| CVE-2024-8248 | Path Traversal in mintplex-labs/anything-llm | |
| CVE-2024-8251 | Prisma Injection in mintplex-labs/anything-llm | |
| CVE-2024-8249 | Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm | |
| CVE-2024-10109 | Incorrect Authorization in mintplex-labs/anything-llm | |
| CVE-2024-10513 | Path Traversal in mintplex-labs/anything-llm |
IV. Related Vulnerabilities
Same product: mintplex-labs/anything-llm
-
CVE-2026-5627
Path Traversal in mintplex-labs/anything-llm -
CVE-2024-8196
Missing Authentication for Critical Function in mintplex-lab -
CVE-2024-8248
Path Traversal in mintplex-labs/anything-llm -
CVE-2024-6842
Exposure of Sensitive Information in mintplex-labs/anything- -
CVE-2024-10513
Path Traversal in mintplex-labs/anything-llm
Same vendor: mintplex-labs
-
CVE-2026-72917
AnythingLLM: Password recovery accepts one recovery code twi -
CVE-2026-55611
AnythingLLM: embed-parsed-file cleanup deletes any parsed fi -
CVE-2026-48789
AnythingLLM: Windows path containment bypass in document fol -
CVE-2026-47713
AnythingLLM: Legacy mobile device tokens bypass multi-user w -
CVE-2026-48116
AnythingLLM: RCE via ripgrep --pre argument injection in fil
Same weakness: CWE-400
-
CVE-2026-4671
justhtml before 1.18.0 Denial of Service via CSS Selector -
CVE-2026-53531
ratex-parser has unbounded parser recursion that leads to st -
CVE-2026-77354
kin-openapi: Uncontrolled resource consumption in openapi3fi -
CVE-2026-55241
Checkmate: Pre-auth Denial of Service via File Upload on Reg -
CVE-2026-77755
Denial of Service in MISP-STIX Import via Malformed or Overs
V. Comments for CVE-2024-7771
No comments yet