AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

LlamaIndexGHSA-7c85-87cp-mr6g

LlamaIndex Vulnerable to Denial of Service (DoS)

LlamaIndex

CVE-2025-1752 · Published May 10, 2025 · updated Jul 7, 2026

High7.5
Fix: upgrade to 0.12.21 or later
GitHub advisory

A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_depth parameter in the get_article_urls function. This allows an attacker to exhaust Python's recursion limit through repeated function calls, leading to resource consumption and ultimately crashing the Python process.

Affected versions

PackageAffectedFixed in
llama-index
PyPI
>= 0.12.15, < 0.12.210.12.21
Details and references

More LlamaIndex advisories

All LlamaIndex