CVE-2024-8249— Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm
Quick assessment
Affected
mintplex-labs mintplex-labs/anything-llm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AnythingLLM是Mintplex开源的一个一体化AI应用程序。 AnythingLLM 6dc3642版本存在安全漏洞，该漏洞源于嵌入聊天功能的API存在未经验证的拒绝服务，攻击者可以通过发送畸形JSON负载导致服务器崩溃。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-8249
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm
Source: CVE Program / CVE List V5
Vulnerability Description
mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionality. An attacker can exploit this vulnerability by sending a malformed JSON payload to the API endpoint, causing a server crash due to an uncaught exception. This issue is fixed in version 1.2.2.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5
Vulnerability Title
AnythingLLM 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
AnythingLLM是Mintplex开源的一个一体化AI应用程序。 AnythingLLM 6dc3642版本存在安全漏洞，该漏洞源于嵌入聊天功能的API存在未经验证的拒绝服务，攻击者可以通过发送畸形JSON负载导致服务器崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified ~ 1.2.2 | - |
|
II. Public POCs for CVE-2024-8249
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-8249
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-8249 (1)
Vendor Advisories for CVE-2024-8249 (1)
Same Patch Batch · mintplex-labs · 2025-03-20 · 9 CVEs total
| CVE-2024-6842 | Exposure of Sensitive Information in mintplex-labs/anything-llm | |
| CVE-2024-13060 | Improper Authorization in mintplex-labs/anything-llm | |
| CVE-2024-7771 | Denial of Service in mintplex-labs/anything-llm | |
| CVE-2024-8196 | Missing Authentication for Critical Function in mintplex-labs/anything-llm | |
| CVE-2024-8248 | Path Traversal in mintplex-labs/anything-llm | |
| CVE-2024-8251 | Prisma Injection in mintplex-labs/anything-llm | |
| CVE-2024-10109 | Incorrect Authorization in mintplex-labs/anything-llm | |
| CVE-2024-10513 | Path Traversal in mintplex-labs/anything-llm |
IV. Related Vulnerabilities
Same product: mintplex-labs/anything-llm
-
CVE-2026-5627
Path Traversal in mintplex-labs/anything-llm -
CVE-2024-8196
Missing Authentication for Critical Function in mintplex-lab -
CVE-2024-8248
Path Traversal in mintplex-labs/anything-llm -
CVE-2024-6842
Exposure of Sensitive Information in mintplex-labs/anything- -
CVE-2024-10513
Path Traversal in mintplex-labs/anything-llm
Same vendor: mintplex-labs
-
CVE-2026-88055
AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Co -
CVE-2026-72917
AnythingLLM: Password recovery accepts one recovery code twi -
CVE-2026-55611
AnythingLLM: embed-parsed-file cleanup deletes any parsed fi -
CVE-2026-48789
AnythingLLM: Windows path containment bypass in document fol -
CVE-2026-47713
AnythingLLM: Legacy mobile device tokens bypass multi-user w
Same weakness: CWE-248
-
CVE-2026-102984
Astro: Malformed port in the Host header can crash the Node -
CVE-2026-96274
Uncaught exception in Baicells Nova 430H -
CVE-2026-102281
Nest: Remote process termination via a deeply nested microse -
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verificatio -
CVE-2026-101101
ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaug
V. Comments for CVE-2024-8249
No comments yet