CVE-2024-5216

A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumption. Specifically, the issue arises from the application's failure to limit the size of usernames, enabling attackers to create users with excessively bulky texts in the username field. This exploit results in the user management panel becoming unresponsive, preventing administrators from performing critical user management actions such as editing, suspending, or deleting users. The impact of this vulnerability includes administrative paralysis, compromised security, and operational disruption, as it allows malicious users to perpetuate their presence within the system indefinitely, undermines the system's security posture, and degrades overall system performance.

• CWE-400

• https://github.com/mintplex-labs/anything-llm/commit/3ef009de73c837f9025df8bba62572885c70c72fPatch
• https://huntr.com/bounties/8ec14991-ee35-493d-a8d3-21a1cfd57869Exploit, Third Party Advisory
• https://github.com/mintplex-labs/anything-llm/commit/3ef009de73c837f9025df8bba62572885c70c72fPatch
• https://huntr.com/bounties/8ec14991-ee35-493d-a8d3-21a1cfd57869Exploit, Third Party Advisory

Published

Jun 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5210A denial-of-service vulnerability was reported in some Lenov…6.5
• CVE-2024-5211A path traversal vulnerability in mintplex-labs/anything-llm…7.2
• CVE-2024-5212The tagDiv Composer plugin for WordPress is vulnerable to Re…6.1
• CVE-2024-5213In mintplex-labs/anything-llm versions up to and including 1…6.5
• CVE-2024-5214Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-5215The HT Mega – Absolute Addons For Elementor plugin for WordP…5.4
• CVE-2024-5217ServiceNow has addressed an input validation vulnerability t…9.8
• CVE-2024-5218The Reviews and Rating – Google Reviews plugin for WordPress…6.4
• CVE-2024-5219The Easy Google Maps plugin for WordPress is vulnerable to S…5.4
• CVE-2024-5220The ND Shortcodes plugin for WordPress is vulnerable to Stor…5.4
• CVE-2024-5221The Qi Blocks plugin for WordPress is vulnerable to Stored C…5.4
• CVE-2024-5222The Responsive Addons – Starter Templates, Advanced Features…5.4