Skip to content
OpenAdvisories
Medium · 5.9 CVE-2024-1455 EUVD-2024-0987GHSA-q84m-rmw3-4382PYSEC-2026-1519

Billion Laughs Attack leading to DoS in langchain-ai/langchain

Published Mar 26, 2024 · Updated Aug 15, 2024 · Assigned by @huntr_ai

Description

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).

Affected products

VendorProductAffectedFixed
langchain-ai langchain-ai/langchain unspecified – < 0.1.35 0.1.35

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI langchain-core < 0.1.35 0.1.35 GHSA-q84m-rmw3-4382

References