What’s Vulnerable › Vulnerabilities

CVE-2024-1455: Billion Laughs Attack leading to DoS in langchain-ai/langchain

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-26 · updated 2026-06-17
• Weakness: CWE-776

Description

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).

Affected products

• langchain-ai/langchain: from 0.1.4 through 0.1.35

References

• https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3
• https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6
• https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3
• https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6

Get alerted when CVE-2024-1455 or the next vulnerability affects your stack