CVE-2025-6208CWE-400

Uncontrolled Memory Consumption in run-llama/llama_index

Medium · published February 2, 2026

CVSS v3.0
5.3
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (`num_files_limit`) is applied after all files in a directory are loaded into memory. This can lead to memory exhaustion and degraded performance, particularly in environments with limited resources. The issue is resolved in version 0.12.41.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00421 · 35.3th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-02-02T10:36Z
EPSS history
Timeline
  • 02 FEB 10:36Z
    Uncontrolled Memory Consumption in run-llama/llama_index
    cvelistv5