Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · LiteLLM

CVE-2024-8984: LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

highCVSS 3.0 7.5GHSA-fh2c-86xm-pm2x

A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable.

Published Mar 20, 2025 · Updated Oct 15, 2025

Affected packages

litellm

Ecosystem
PyPI
Affected
< 1.56.2
Fixed in
1.56.2
Check
pip show litellm

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.

Credited to ishaan-jaff.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LiteLLM vulnerabilities

All LiteLLM entries