Resource Exhaustion Vulnerability in LibreChat by Danny Avila
CVE-2026-54037

6.5MEDIUM

Key Information:

Vendor

Danny-avila

Status
Librechat
Vendor
CVE Published:
25 June 2026

What is CVE-2026-54037?

LibreChat, an enhanced ChatGPT clone, exhibits a vulnerability that allows authenticated users to bypass newly implemented rate limiters on certain API endpoints. Specifically, while the POST /api/convos/fork endpoint was designed to limit resource usage, the POST /api/convos/duplicate endpoint lacked similar restrictions. This oversight could enable an attacker to exploit the system by executing rapid requests to exhaust server resources, risking denial of service. This vulnerability has been addressed in version 0.8.4-rc1.

Affected Version(s)

LibreChat < 0.8.4-rc1

References

https://github.com/danny-avila/LibreChat/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.