Homepage

Out-of-bounds Read Affecting litellm-1.84 package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.3% (23rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-LITELLM184-18521383
  • published5 Aug 2026
  • disclosed3 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 3 Aug 2026

NewCVE-2026-69244  (opens in a new tab)
CWE-125  (opens in a new tab)
CWE-400  (opens in a new tab)
CWE-416  (opens in a new tab)

How to fix?

There is no fixed version for Minimos:latest litellm-1.84.

NVD Description

Note: Versions mentioned in the description apply only to the upstream litellm-1.84 package and not the litellm-1.84 package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.