Disclosed weakness · no CVE recorded

Some LiteLLM streaming responses skipped output checks

LiteLLM · LiteLLM Proxy

First documented disclosure · Review checkpoint

Summary

Clients could receive streamed model output before the configured policy had scanned, masked or blocked it.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Affected streaming paths did not consistently pass model output through the configured post-response guardrails.

Conditions required

Streaming output and post-response masking or blocking are enabled on an affected path.

Potential impact

Streamed output could reach clients without the expected scanning, masking or blocking.

Affected versions and configurations

The affected behavior is documented. The full version range is not established.

Fix and mitigation status

1.109.0 lists this correction; other release lines may differ.

Practical next steps

Use a release containing this correction. Verify streaming output policy for each model and route in use.

Operating lesson

Test streamed and buffered responses separately for the same policy.

Evidence and limits

The project describes the correction in the linked public changes and lists it in 1.109.0. No CVE assignment or complete affected range was established.

Sources