CVE-2024-1455

Katalog CVE

CVSS 5.9 · Medium EPSS 0,76%

Kerentanan Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') pada langchain. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).

Rincian

Terbit di NVD

26 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 54,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3 patch
• https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6 exploit · advisory pihak ketiga