Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mozilla-ai/any-llm

              main @ ca0ef07
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Denial of Service: 2 prior fixes. Scrutinize any change in this area.

src/any_llm/gateway/server.py: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The configuration parser fell back to insecure literal placeholder values when referenced environment variables were missing, allowing unauthorized access using default credentials. Failing fast during startup resolves this risk.

Race Condition: Concurrent requests could bypass gateway budget validation due to a Time-of-Check to Time-of-Use (TOCTOU) vulnerability. This required the implementation of database row-level locking via SELECT FOR UPDATE to ensure atomic verification.

Denial of Service: Unbounded offset and limit parameters in pagination queries enabled database resource exhaustion. Restricting these parameters with validation limits mitigates the threat.