Denial of Service Vulnerability in Mintplex Labs' Dockerized Product

CVE-2024-7771

What is CVE-2024-7771?

A vulnerability exists in the Dockerized version of Mintplex Labs' anything-llm product, where uploading an audio file with an extremely low sample rate can cause the transcription service to crash. This issue is rooted in the localWhisper implementation, which attempts to resample audio from 1 Hz to 16000 Hz, consuming excessive memory and ultimately leading to the termination of the Docker instance by the instance manager. This can disrupt service availability and affect users relying on audio transcription capabilities.

References