CVE-2025-1752

Katalog CVE

CVSS 7.5 · High EPSS 0,52%

Kerentanan Uncontrolled Recursion pada llamaindex. Skor CVSS 3.0 7.5 (High) menurut huntr.dev.

Deskripsi (NVD)

A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_depth parameter in the get_article_urls function. This allows an attacker to exhaust Python's recursion limit through repeated function calls, leading to resource consumption and ultimately crashing the Python process.

Rincian

Terbit di NVD

10 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.0

7.5 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-674: Uncontrolled Recursion

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/run-llama/llama_index/commit/3c65db2947271de3bd1927dc66a044da385de4da patch
• https://huntr.com/bounties/cd7b9082-7d75-42e4-84f5-dbee23cbc467 exploit · advisory pihak ketiga