AnythingLLMPublished 6 Jun 2024NVD status: Modified

CVE-2024-3153

AnythingLLM: mintplex-labs/anything-llm is affected by an uncontrolled resource consumption vulnerability in its upload file endpoint, leading to a denial of service (DOS) condition.

ComponentAnythingLLM
Severitymedium (CVSS 6.5)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published (NVD)2024-06-06
Last modified2026-06-17
Affected versions
< 1.0.0
from the CVE Program record written by the CNA that assigned the CVE
Fixed in1.0.0
WeaknessCWE-400
CISA KEVnot listed

NVD description

mintplex-labs/anything-llm is affected by an uncontrolled resource consumption vulnerability in its upload file endpoint, leading to a denial of service (DOS) condition. Specifically, the server can be shut down by sending an invalid upload request. An attacker with the ability to upload documents can exploit this vulnerability to cause a DOS condition by manipulating the upload request.

What to do

  • Upgrade AnythingLLM to 1.0.0 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources