LlamaIndexGHSA-7753-xrfw-ch36

LlamaIndex affected by a Denial of Service (DOS) in JSONReader

High8.6CVE-2025-5302 · Published Aug 26, 2025 · updated Jul 7, 2026

Affected versions

Package	Affected	Fixed in
llama-index-core PyPI	< 0.12.38	0.12.38

Details and references

A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth limit. This results in high resource consumption and potential crashes of the Python process. The issue is resolved in version 0.12.38.

CVSS 3.0: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-674
Also known as: CVE-2025-5302, PYSEC-2026-1561

More LlamaIndex advisories

All LlamaIndex

Date	Advisory	Severity	Fixed in
Sep 272025	llama-index-core insecurely handles temporary files CVE-2025-7647High7.3fixed in 0.13.0	High7.3	0.13.0
Jul 102025	LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class CVE-2025-6211Medium6.5fixed in 0.12.41	Medium6.5	0.12.41
Oct 132025	llama-index has Insecure Temporary File CVE-2025-7707High7.1fixed in 0.13.0	High7.1	0.13.0
Jul 72025	LlamaIndex vulnerable to Path Traversal attack through its encode_image function CVE-2025-6209High7.5fixed in 0.12.41	High7.5	0.12.41
Jul 72025	LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing CVE-2025-5472Medium6.5fixed in 0.12.38	Medium6.5	0.12.38
Jul 72025	A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal. This flaw permits attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting hardlinks. The CVE-2025-6210Medium6.2fixed in 0.5.2	Medium6.2	0.5.2

Affected versions

More LlamaIndex advisories

Critical advisories by email