Denial of service in langchain-community

中 4.7CVE-2024-2965 · GHSA-3hjh-jh2h-vrg6 · PYSEC-2024-118 · 06/06/2024 公開 · 17/06/2026 更新

要点

CVE-2024-2965 は langchain, langchain-community, langchain (langchain) に影響する深刻度「中」 (CVSS 4.7) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.30%（全脆弱性の 23.2% より高い）。
対処：0.2.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
langchain PyPI	`< 0.2.5`	`0.2.5`
langchain-community PyPI	`< 0.2.5`	`0.2.5`
langchain langchain	`< 0.2.5`	`0.2.5`

概要

Denial of service in SitemapLoader Document Loader in the langchain-community package, affecting versions below 0.2.5. The parse_sitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.

NVD の説明

A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.