GitHub Advisoryadvisory · PyPI

GHSA-7753-xrfw-ch36 LlamaIndex affected by a Denial of Service (DOS) in JSONReader

HIGH Published 2025-08-26 Modified 2025-08-26 Official page ↗
Aliases
CVE-2025-5302
Ecosystem
PyPI
Packages
llama-index-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weaknesses
CWE-674
Reviewed
2025-08-26

Affected packages

• PyPI llama-index-core: < 0.12.38 → fixed in 0.12.38

Description

A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth limit. This results in high resource consumption and potential crashes of the Python process. The issue is resolved in version 0.12.38.

Related

Alias · CVE (1)

  • CVE-2025-5302 A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version… vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References