TI-2024-10349 Aliases CVE-2024-11172 GHSA-6827-g8xf-36c7

Denial of Service in danny-avila/librechat

HIGH 72CWE-248Published 2025-03-20 · Updated 2025-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This issue is fixed in version 0.7.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00935 61st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed danny-avila/librechat (danny-avila): 0.7.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
danny-avila	danny-avila/librechat	before 0.7.6	0.7.6	Patch available	CNA

danny-avila/librechat Vendordanny-avila Affected before 0.7.6 Fixed in 0.7.6 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:librechat:librechat::::::::	before 0.7.6	Vulnerable	danny-avila

cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:* Versions before 0.7.6 Vulnerable ·danny-avila

Remediation

Fix · CNA danny-avila/librechat (danny-avila) Fixed in 0.7.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-03-20
danny-avila/librechat 0.7.6
7 records Highest priority Priority HIGH 5 HIGH, 2 MEDIUM
Other records, highest priority first
- TI-2024-10347 Path Traversal in danny-avila/librechatPriority HIGH 73
- TI-2024-10348 Improper Input Validation in danny-avila/librechatPriority HIGH 72
- TI-2024-10346 Unhandled Exception Leading to Server Crash in danny-avila/librechatPriority HIGH 72
Show all 7 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-11172
2026-10-03 Alias added: GHSA-6827-g8xf-36c7

References

Exploit 1

https://huntr.com/bounties/c76a7ee3-2e26-45a0-8940-21c749592105

Patch 1

https://github.com/danny-avila/librechat/commit/976784c01fa4cce00d4c2941801d56aed375c21b

TI-2026-25134 LibreChat Exfiltrates Server Secrets via MCP Server URL Injection CVSS 3.1CRITICAL 9.6
TI-2026-17862 LibreChat MCP Stdio Remote Command Execution CVSS 3.1CRITICAL 9.9
TI-2026-38976 LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow CVSS 3.1CRITICAL 9.3
TI-2024-27763 LibreChat through 0.7.4-rc1 has incorrect access control for message updates. CVSS 3.1CRITICAL 9.8
TI-2024-10347 Path Traversal in danny-avila/librechat CVSS 3.0HIGH 8.8
TI-2026-25682 In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API. CVSS 3.1CRITICAL 9.0

See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences