TI-2024-09448 Aliases CVE-2024-10188 GHSA-gw2q-qw9j-rgv7

Denial of Service in BerriAI/litellm

HIGH 72CWE-400Published 2025-03-20 · Updated 2025-03-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_eval to parse user input. This function is not safe and is prone to DoS attacks, which can crash the litellm Python server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00569 47th percentileScored 2026-11-07

Fix Fixed berriai/litellm (berriai): 1.53.1litellm (PyPI): 1.53.1.dev1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
BerriAI	berriai/litellm	before 1.53.1	1.53.1	Patch available	CNA
—	litellm (PyPI)	before 1.53.1.dev1	1.53.1.dev1	Patch available	GHSA-gw2q-qw9j-rgv7

berriai/litellm VendorBerriAI Affected before 1.53.1 Fixed in 1.53.1 Patch available CNA
litellm (PyPI) Vendor— Affected before 1.53.1.dev1 Fixed in 1.53.1.dev1 Patch available GHSA-gw2q-qw9j-rgv7

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:litellm:litellm::::::::	—	—	BerriAI

cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:* Versions — — ·BerriAI

Remediation

Fix · CNA berriai/litellm (berriai) Fixed in 1.53.1
Fix · GHSA-gw2q-qw9j-rgv7 litellm (PyPI) Fixed in 1.53.1.dev1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-10188
2026-10-03 Alias added: GHSA-gw2q-qw9j-rgv7

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-10188

Other 3

TI-2026-26015 Trivy ecosystem supply chain briefly compromised KEVCVSS 4.0CRITICAL 9.4
TI-2026-30529 LiteLLM: SQL injection in Proxy API key verification KEVCVSS 4.0CRITICAL 9.3
TI-2026-30582 LiteLLM: Authenticated command execution via MCP stdio test endpoints KEVCVSS 4.0HIGH 8.7
TI-2026-42639 LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback KEVCVSS 4.0HIGH 8.8
TI-2024-05340 Remote Code Execution in BerriAI/litellm CVSS 3.1CRITICAL 9.8
TI-2024-03969 Remote Code Execution in berriai/litellm CVSS 3.0CRITICAL 9.8

See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences