CVE-2025-1752CWE-674

Denial of Service in run-llama/llama_index

High · published May 10, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
43.4
In the wild
Unconfirmed
What it is

A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_depth parameter in the get_article_urls function. This allows an attacker to exhaust Python's recursion limit through repeated function calls, leading to resource consumption and ultimately crashing the Python process.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00521 · 43.4th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2025-05-10T13:21Z
EPSS history
Timeline
  • 10 MAY 13:21Z
    Denial of Service in run-llama/llama_index
    cvelistv5