A vulnerability in the LangChainLLM class of the run-llama/llama_index repository, version v0.12.5, allows for a Denial of Service (DoS) attack. The stream_complete method executes the llm using a thread and retrieves the result via the get_response_gen method of the StreamingGeneratorCallbackHandler class. If the thread terminates abnormally before the _llm.predict is executed, there is no exception handling for this case, leading to an infinite loop in the get_response_gen function. This can be triggered by providing an input of an incorrect type, causing the thread to terminate and the process to continue running indefinitely.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/run-llama/llama_index/commit/d1ecfb77578d089cbe66728f18f635c09aa32a05 | Patch |
| https://huntr.com/bounties/a0b638fd-21c6-4ba7-b381-6ab98472a02a | Exploit Third Party Advisory |
Configurations
History
31 Jul 2025, 16:09
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Llamaindex llamaindex
Llamaindex |
|
| CPE | cpe:2.3:a:llamaindex:llamaindex:0.12.5:*:*:*:*:*:*:* | |
| References | () https://huntr.com/bounties/a0b638fd-21c6-4ba7-b381-6ab98472a02a - Exploit, Third Party Advisory | |
| References | () https://github.com/run-llama/llama_index/commit/d1ecfb77578d089cbe66728f18f635c09aa32a05 - Patch |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-31 16:09
NVD link : CVE-2024-12704
Mitre link : CVE-2024-12704
JSON object : View
Products Affected
llamaindex
- llamaindex
CWE
CWE-755
Improper Handling of Exceptional Conditions