Denial of Service Vulnerability in LibreChat by Danny Avila

CVE-2025-8849

What is CVE-2025-8849?

LibreChat version 0.7.9 is susceptible to a Denial of Service attack stemming from unbounded parameter values in the /api/memories endpoint. The key and value parameters are not properly validated, allowing attackers to submit excessively large inputs. This flaw can induce a null pointer error in the Rust-based backend, disrupting the ability to create new memories and causing service instability.

References