CVEvulnerability
CVE-2024-1455
5.9 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2024-03-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.0 ([email protected])
- 5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-776
Description
A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).
Affected configurations
• langchain langchain (>= 0.1.4 <= 0.1.35)
Related
Weakness · CWE (1)
- CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness
References
- https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3 Patch
- https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6 Exploit, Third Party Advisory
- https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3 Patch
- https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6 Exploit, Third Party Advisory