Issue Station
Sign In
Tools hereToolbox

litellm - 💡(How to fix) Fix GHSA-g26j-5385-hhw3: claimed fixed version 1.44.8 still ships pre-fix code [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
BerriAI/litellm#26186•Fetched 2026-04-22 07:45:53
View on GitHub
Comments
0
Participants
1
Timeline
0
Reactions
0
Author
DEVSOG12DEVSOG12
Participants
DEVSOG12DEVSOG12
RAW_BUFFERClick to expand / collapse

Advisory: GHSA-g26j-5385-hhw3 (CVE-2024-6587) Claimed fixed version: 1.44.8 Correct first fixed version: 1.44.9

git merge-base --is-ancestor ba1912afd1b1 v1.44.8 returns false. The fix commit is not in the ancestry of the v1.44.8 release tag. The 1.44.8 artifact on PyPI ships litellm/proxy/auth/auth_checks.py byte-identical to the pre-fix state (SSRF protection absent). The fix first appears in 1.44.9.

The advisory's fixed version should be corrected from 1.44.8 to 1.44.9.

extent analysis

TL;DR

Update the advisory to reflect that version 1.44.9 is the first version with the fix for CVE-2024-6587.

Guidance

  • Verify the fix by checking the litellm/proxy/auth/auth_checks.py file in version 1.44.9 to ensure it includes the SSRF protection.
  • Update any dependencies or references to use version 1.44.9 instead of 1.44.8 to ensure the security fix is applied.
  • Review the release history and changelog to understand the changes made between versions 1.44.8 and 1.44.9.
  • Notify any affected teams or users about the corrected fixed version to ensure they update to the secure version.

Notes

The issue specifically mentions that the fix commit is not in the ancestry of the v1.44.8 release tag, which implies that version 1.44.8 does not contain the security fix.

Recommendation

Apply workaround: Update to version 1.44.9, as it is the first version that includes the fix for CVE-2024-6587, providing the necessary SSRF protection.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#ssr#generation error#database connection#vector store#embedding generation

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING