CVE-2024-2965 Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchain
Attackers can cause a crash and resource exhaustion in LangChain's SitemapLoader by triggering infinite recursion via self-referencing sitemaps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-2965?
CVE-2024-2965 is a medium-severity denial of service vulnerability in langchain-ai/langchain, published on 6 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.
Weakness: CWE-674
Which versions are affected by CVE-2024-2965?
6 open source packages ship an affected version, including langchain and langchain-community. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
langchain PyPI | All versions | 0.2.5 |
langchain PyPI | All versions | 0.2.5 |
langchain PyPI | All versions | 0.2.5 |
langchain-community PyPI | All versions | 0.2.5 |
langchain-community PyPI | All versions | 0.2.5 |
langchain-community PyPI | All versions | 0.2.5 |
Products include Langchain Langchain.
How do I fix CVE-2024-2965?
Upgrade langchain to 0.2.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-2965 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2965 exists.
Other vulnerabilities in langchain-ai/langchain
- CVE-2023-39631 Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library
- CVE-2023-36281 langchain vulnerable to arbitrary code execution
- CVE-2023-38860 LangChain vulnerable to arbitrary code execution
- CVE-2023-38896 LangChain vulnerable to arbitrary code execution
- CVE-2023-39659 LangChain vulnerable to arbitrary code execution
Sources
Also known as GHSA-3hjh-jh2h-vrg6, PYSEC-2024-118, PYSEC-2026-2561.