Unauthenticated Denial of Service Vulnerability in Anything-LLM by Mintplex Labs

CVE-2024-8249

What is CVE-2024-8249?

The Anything-LLM product by Mintplex Labs is vulnerable to an unauthenticated Denial of Service issue within its embeddable chat API. An attacker can exploit this vulnerability by submitting a specially crafted malformed JSON payload to the API endpoint. This action triggers an uncaught exception, potentially leading to a server crash. It is essential for users of Anything-LLM to upgrade to version 1.2.2 or later to mitigate this risk. For more information, refer to the commit and the bounty details.

References