Denial of service in langchain-community

TRUNG BÌNH 4.7CVE-2024-2965 · GHSA-3hjh-jh2h-vrg6 · PYSEC-2024-118 · Công bố 06/06/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-2965 là lỗ hổng mức TRUNG BÌNH (CVSS 4.7) ảnh hưởng langchain, langchain-community, langchain (langchain).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.30%, cao hơn 23.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.2.5 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
langchain PyPI	`< 0.2.5`	`0.2.5`
langchain-community PyPI	`< 0.2.5`	`0.2.5`
langchain langchain	`< 0.2.5`	`0.2.5`

Mô tả

Denial of service in SitemapLoader Document Loader in the langchain-community package, affecting versions below 0.2.5. The parse_sitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.

Mô tả của NVD

A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.