CVE-2024-10188: 
LiteLLM vulnerability analysis and mitigation

A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_eval to parse user input. This vulnerability was discovered in March 2024 and affects the litellm Python server (NVD).

The vulnerability stems from the unsafe use of ast.literal_eval function for parsing user input in the litellm Python server. The CVSS v3.0 score for this vulnerability is 7.5 (HIGH) with the following vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and primarily affects system availability (NVD).

When exploited, this vulnerability can cause a Denial of Service (DoS) condition that crashes the litellm Python server. The impact is primarily focused on system availability, with no direct effect on confidentiality or integrity of the system (NVD).

A fix has been implemented in the BerriAI/litellm repository through commit 21156ff5d0d84a7dd93f951ca033275c77e4f73c, which removes the use of ast.literal_eval from HTTP utils (Github Commit).