Advisoriesby IbisLlamaIndexGHSA-7753-xrfw-ch36
LlamaIndex affected by a Denial of Service (DOS) in JSONReader
Fix: upgrade to 0.12.38 or later
A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth limit. This results in high resource consumption and potential crashes of the Python process. The issue is resolved in version 0.12.38.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| llama-index-core PyPI | < 0.12.38 | 0.12.38 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-674
- Also known as
- CVE-2025-5302, PYSEC-2026-1561
More LlamaIndex advisories
All LlamaIndex
llama-index has Insecure Temporary FileCVE-2025-7707fixed in 0.13.0llama-index-core insecurely handles temporary filesCVE-2025-7647fixed in 0.13.0LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader classCVE-2025-6211fixed in 0.12.41LlamaIndex vulnerable to Path Traversal attack through its encode_image functionCVE-2025-6209fixed in 0.12.41LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsingCVE-2025-5472fixed in 0.12.38LlamaIndex: path traversalCVE-2025-6210fixed in 0.5.2