What’s Vulnerable › Vulnerabilities

CVE-2024-3153: Uncontrolled Resource Consumption in mintplex-labs/anything-llm

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-06 · updated 2026-06-17
• Weakness: CWE-400

Description

mintplex-labs/anything-llm is affected by an uncontrolled resource consumption vulnerability in its upload file endpoint, leading to a denial of service (DOS) condition. Specifically, the server can be shut down by sending an invalid upload request. An attacker with the ability to upload documents can exploit this vulnerability to cause a DOS condition by manipulating the upload request.

Affected products

• Mintplexlabs Anythingllm: before 1.0.0 — fixed in 1.0.0

How to fix

Upgrade to a fixed version: Mintplexlabs Anythingllm 1.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/mintplex-labs/anything-llm/commit/b8d37d9f43af2facab4c51146a46229a58cb53d9
• https://huntr.com/bounties/7bb08e7b-fd99-411e-99bc-07f81f474635
• https://github.com/mintplex-labs/anything-llm/commit/b8d37d9f43af2facab4c51146a46229a58cb53d9
• https://huntr.com/bounties/7bb08e7b-fd99-411e-99bc-07f81f474635

Get alerted when CVE-2024-3153 or the next vulnerability affects your stack