CVE-2024-7771 Details
Description
A vulnerability in the Dockerized version of mintplex-labs/anything-llm (latest, digest 1d9452da2b92) allows for a denial of service. Uploading an audio file with a very low sample rate causes the functionality responsible for transcribing it to crash the entire site instance. The issue arises from the localWhisper implementation, where resampling the audio file from 1 Hz to 16000 Hz quickly exceeds available memory, leading to the Docker instance being killed by the instance manager.
A denial-of-service vulnerability has been identified in the Dockerized version of Mintplex Labs Anything-LLM, specifically in the latest release with digest 1d9452da2b92. The issue arises when an audio file with an extremely low sample rate is uploaded, causing the transcription functionality to crash the entire site instance. This problem is linked to the localWhisper implementation, where resampling the audio from 1 Hz to 16 kHz rapidly consumes available memory, resulting in the Docker instance being terminated by the instance manager.
Users can update to the patched version of Mintplex Anything-LLM, which includes audio file validation to prevent low sample rate files from being uploaded. Instructions for updating can be found in the Mintplex Labs GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mintplex-labs/anything-llm/commit/dd017c6cbbf42abdef7861a66558c53b66424d07 | [email protected] | Patch |
| https://huntr.com/bounties/a31a9834-e9c4-4b50-a1ec-ecb69f2a6142 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mintplexlabs anythingllm | < 1.3.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2025 | Initial Analysis | [email protected] |
| Mar 20, 2025 | New CVE Received | [email protected] |