AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

LlamaIndexGHSA-488g-hw5f-x29p

llama-index-core vulnerable to Uncontrolled Resource Consumption

LlamaIndex

CVE-2025-6208 · Published Feb 2, 2026 · updated Jul 7, 2026

Medium5.3
Fix: upgrade to 0.12.41 or later
GitHub advisory

The SimpleDirectoryReader component in llama_index.core version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (num_files_limit) is applied after all files in a directory are loaded into memory. This can lead to memory exhaustion and degraded performance, particularly in environments with limited resources. The issue is resolved in version 0.12.41.

Affected versions

PackageAffectedFixed in
llama-index-core
PyPI
< 0.12.410.12.41
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400
Also known as
CVE-2025-6208, PYSEC-2026-1560

More LlamaIndex advisories

All LlamaIndex