CVE-2024-1455CWE-776

Billion Laughs Attack leading to DoS in langchain-ai/langchain

Medium · published March 26, 2024

CVSS v3.0
5.9
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).

The record
Technical detail
CVSS v3.0
5.9 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00764 · 54.9th percentile
Weakness
CWE-776 · Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Published
2024-03-26T14:03Z
EPSS history
Timeline
  • 26 MAR 14:03Z
    Billion Laughs Attack leading to DoS in langchain-ai/langchain
    cvelistv5