CVE-2024-2965
Description
A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.
How to fix
- langchain langchain0.2.5 or later
- langchain-community0.2.5 or later
- langchain0.2.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| langchain langchain | v < 0.2.5 | 0.2.5 |
| langchain-communityPyPI | v < 0.2.5 | 0.2.5 |
| langchainPyPI | v < 0.2.5 | 0.2.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.