AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

LlamaIndexGHSA-jvpf-xf32-2w4q

LlamaIndex Uncontrolled Resource Consumption vulnerability

LlamaIndex

CVE-2024-12910 · Published Mar 20, 2025 · updated Oct 15, 2025

Medium5.9
Fix: upgrade to 0.12.9 or later
GitHub advisory

A vulnerability in the KnowledgeBaseWebReader class of the run-llama/llama_index repository, version latest, allows an attacker to cause a Denial of Service (DoS) by controlling a URL variable to contain the root URL. This leads to infinite recursive calls to the get_article_urls method, exhausting system resources and potentially crashing the application.

Affected versions

PackageAffectedFixed in
llama-index
PyPI
< 0.12.90.12.9
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400, CWE-674
Also known as
CVE-2024-12910, PYSEC-2025-11

More LlamaIndex advisories

All LlamaIndex
Critical 9.8Jun 5, 2025llama_index vulnerable to SQL InjectionCVE-2025-1793fixed in 0.12.28Critical 9.8Jun 2, 2025LlamaIndex: SQL injectionCVE-2025-1750fixed in 0.12.21High 7.8May 28, 2025LlamaIndex: command injectionCVE-2025-1753no fix yetHigh 7.5May 10, 2025LlamaIndex Vulnerable to Denial of Service (DoS)CVE-2025-1752fixed in 0.12.21High 7.1Mar 20, 2025LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure PermissionsCVE-2024-12911fixed in 0.12.3High 7.5Mar 20, 2025LlamaIndex Improper Handling of Exceptional Conditions vulnerabilityCVE-2024-12704fixed in 0.12.6