CVE-2024-10188High· 7.5▾ TwilightLiteLLM Vulnerable to Denial of Service (DoS)
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.5%
Last analysed / modified upstream
0.5% → 0.6%
A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_eval to parse user input. This function is not safe and is prone to DoS attacks, which can crash the litellm Python server.
litellm < 1.53.1.dev1Upgrade to a patched release:
litellm 1.53.1.dev1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59823Medium· 5.3LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
CVE-2026-12799Medium· 4.3BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
CVE-2026-12796Medium· 6.3BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
CVE-2026-12797Medium· 6.3BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
CVE-2026-12798Medium· 6.3BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
GHSA-69x8-hrgq-fjj8HighLiteLLM: Password hash exposure and pass-the-hash authentication bypass