rewindex

RewindexCVEsLangChain (LangSmith)

CVE-2024-58340: LangChain <= 0.3.1 MRKLOutputParser ReDoS

High · CVSS 7.5 (CVSS 3.1)EPSS 0.48%, 41th percentilePublished Updated Assigner: VulnCheck

Description

LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_parser.py). The parser applies a backtracking-prone regular expression when extracting tool actions from model output. An attacker who can supply or influence the parsed text (for example via prompt injection in downstream applications that pass LLM output directly into MRKLOutputParser.parse()) can trigger excessive CPU consumption by providing a crafted payload, causing significant parsing delays and a denial-of-service condition.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · CWE-1333

Tracked companies

LangChain (LangSmith)

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

LangChain AI: LangChain

References

All CVEsMarkdownJSON