CVE Feed

    Dashboard / CVE / CVE-2024-11172

    CVE-2024-11172

    A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This issue is fixed in version 0.7.6.

    Published:Mar 20, 2025
    Last Modified:Oct 15, 2025
    EPS:Mar 20, 2025
    EPSS Score:0.00325
    CVSS Score:7.5

    Affected Products

    Vendor
    Librechat
    Product
    Librechat

    Exploits

    https://huntr.com/bounties/c76a7ee3-2e26-45a0-8940-21c749592105

    Common Weakness Enumeration

    CWE-248 Uncaught Exception

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-44654 (CVSS 5.7) — LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.…
    CVE-2026-44653 (CVSS 6.5) — LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.…
    CVE-2026-32625 (CVSS 9.6) — LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.…
    CVE-2026-31942 (CVSS 7.1) — LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.…
    CVE-2026-34371 (CVSS 6.3) — LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returne…
    CVE-2026-31951 (CVSS 6.8) — LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc1 through 0.8.3-rc1, user-created M…
    CVE-2026-31950 (CVSS 5.3) — LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE stream…
    CVE-2026-31945 (CVSS 7.7) — LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerable to a se…
    CVE-2026-31943 (CVSS 8.5) — LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/ap…
    CVE-2026-33265 (CVSS 6.3) — In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High