p PatchFirst

CVE-2024-58340

CVE-2024-58340 · LangChain <= 0.3.1 MRKLOutputParser ReDoS

This page contains facts from public vulnerability sources. Check the original advisory before updating.

LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_parser.py). The parser applies a backtracking-prone regular expression when extracting tool actions from model output. An attacker who can supply or influence the parsed text (for example via prompt injection in downstream applications that pass LLM output directly into MRKLOutputParser.parse()) can trigger excessive CPU consumption by providing a crafted payload, causing significant parsing delays and a denial-of-service condition.

CVSS 8.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • langchain

    Versions
    • ≥ 0, ≤ 0.3.1: Affected (semver)

    No fix published

  • langchain-exa PyPI

    Versions
    • 0.0.1
    • 0.1.0
    • 0.2.0
    • 0.2.1
    • 0.3.0
    • 0.3.1
    Affected ranges
    • ECOSYSTEM: < 1.0.0a1

    Update to 1.0.0a1

Original sources

Check your server →