CVE-2024-8249 Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm
An attacker can crash the AnythingLLM server by sending a malformed JSON payload to the unauthenticated embeddable chat API endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8249?
CVE-2024-8249 is a high-severity denial of service vulnerability in Mintplexlabs Anythingllm, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionality. An attacker can exploit this vulnerability by sending a malformed JSON payload to the API endpoint, causing a server crash due to an uncaught exception. This issue is fixed in version 1.2.2.
Weakness: CWE-248
Which versions are affected by CVE-2024-8249?
It affects 1 product.
Products include Mintplexlabs Anythingllm.
How do I fix CVE-2024-8249?
No fix has been published for CVE-2024-8249 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-8249 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8249 exists.
Other vulnerabilities in Mintplexlabs Anythingllm
- CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm
- CVE-2024-0455 SSRF on AWS deployed instances of AnythingLLM via /metadata
- CVE-2026-32626 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
- CVE-2024-3104 Remote Code Execution in mintplex-labs/anything-llm
- CVE-2024-3149 SSRF in mintplex-labs/anything-llm
Sources
Also known as GHSA-h5jv-6xg2-9cv8.