CVE-2025-8849 MEDIUM

CVE-2025-8849: Denial of Service in danny-avila/librechat

Vendor Danny-Avila
Product danny-avila/librechat
Weakness CWE-400
Published October 30, 2025
Last update October 31, 2025

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the service.

Key dates

02Disclosure timeline

October 30, 2025 CVE published
October 31, 2025 Record updated