CVE-2024-8249: Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-20 · updated 2026-06-17
Weakness: CWE-248

Description

mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionality. An attacker can exploit this vulnerability by sending a malformed JSON payload to the API endpoint, causing a server crash due to an uncaught exception. This issue is fixed in version 1.2.2.

Affected products

Mintplexlabs Anythingllm: before 1.2.2 — fixed in 1.2.2

How to fix

Upgrade to a fixed version: Mintplexlabs Anythingllm 1.2.2. Check the vendor advisory for mitigations.

References

https://github.com/mintplex-labs/anything-llm/commit/548da9ade30368289c5beaf0a8ee2ed2b5c1d81c
https://huntr.com/bounties/2fb0c93f-5bc1-4212-bdca-292db7c6951f

Get alerted when CVE-2024-8249 or the next vulnerability affects your stack