Billion Laughs Attack leading to DoS in langchain-ai/langchain (langchain-ai langchain-ai/langchain)
En bref
- Source
- NVD
- EPSS
- EPSS 0.76 % · centile 55 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- @huntr_ai
- Statut NVD
- Analyzed
Description
A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).
Faiblesses (CWE)
- CWE-776 — Expansion d'entités XML (XEE / Billion Laughs)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | @huntr_ai |
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | MEDIUM 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · security@huntr.dev (Secondary) |
Avis
- GHSA-q84m-rmw3-4382 — LangChain's XMLOutputParser vulnerable to XML Entity Expansion
- PYSEC-2026-1519 — LangChain's XMLOutputParser vulnerable to XML Entity Expansion
Références européennes
- ENISA EUVD · EUVD-2024-0987
- GCVE · GCVE-0-2024-1455
Avis du CERT-FR
- CERTFR-2025-AVI-0538 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*≥ 0.1.4 ≤ 0.1.35
Produits affectés
| Produit | Versions |
|---|---|
| langchain-ai · langchain-ai/langchain | affected unspecified < 0.1.35 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |