LlamaIndex affected by a Denial of Service (DOS) in JSONReader

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2025-5302 · ADVISORY
• run-llama/llama_index commit c032843 · WEB
• run-llama/llama_index · PACKAGE
• huntr.com/bounties/70041b81-de9e-4046-8c0e-6ccd557048a6 · WEB
• pypi.org/project/llama-index-core · PACKAGE
• GitHub Advisory GHSA-7753-xrfw-ch36 · ADVISORY

llama-index-core のその他の脆弱性

• CVE-2025-6208中 5.3The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource m…
• CVE-2025-7647高 7.3The llama-index-core package, up to version 0.12.44, contains a vulnerability in the `get_cache_dir()` function where a predictable, hardcod…
• CVE-2025-6209高 7.5A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` func…
• CVE-2025-5472中 6.5The JSONReader in run-llama/llama_index versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This …
• CVE-2025-3108高 7.5A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0…