CVE-2025-8849: LibreChat DoS via Unbounded Parameters

Critical Vulnerability Information Vulnerability Title Denial of Service via Unbounded parameter values in danny-avila/librechat Report Date Aug 2nd 2025 Vulnerability Details CVE: CVE-2025-8849 Vulnerability Type: CWE-400: Denial of Service Severity: Medium (5.4) Affected Versions: 0.7.9 Visibility: Public Status: Fixed Description The endpoint in LibreChat accepts arbitrarily large values for the and parameters, which are not properly validated. This leads to a 500 Internal Server Error when over 100 crore (approximately 1 billion) characters are submitted. Users/admins cannot create new memories until the server is restarted, resulting in a Denial of Service for this feature and potentially affecting backend stability. Exploit Script Impact Attackers can exploit this by sending crafted requests with large key and value parameters, crashing the Rust-based service and rendering the memory creation feature unusable. Mitigation Implement strict input validation with character limits (e.g., key ≤ 1000, value ≤ 10000 characters). Leverage Rust's safety mechanisms and proper error handling to prevent null pointer dereferencing. Discoverer Akshay Ravi Fixer Danny Avila Location Fix Commit Commit: edf33bedcbb08c33e59df76f06454ed7efd896f9 Fixed in v0.8.0-rc2

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-8849: LibreChat DoS via Unbounded Parameters