CVE-2024-1455

CVSS V2 None CVSS V3 None

Description

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).

Overview

CVE ID
CVE-2024-1455

Assigner
@huntr_ai

Vulnerability Status
PUBLISHED

Published Version
2024-03-26T14:03:46.647Z

Last Modified Date
2024-04-16T11:10:22.131Z

Weakness Enumerations

CWE	URL
CWE-776	http://cwe.mitre.org/data/definitions/776.html

References

Reference URL	Reference Tags
https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6
https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-1455
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1455

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 06:40:17				Added to TrackCVE