CVE-2025-1752: Denial of Service in run-llama/llama_index

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-10 · updated 2026-06-17
Weakness: CWE-674

Description

A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_depth parameter in the get_article_urls function. This allows an attacker to exhaust Python's recursion limit through repeated function calls, leading to resource consumption and ultimately crashing the Python process.

Affected products

run-llama/llama_index: before 0.3.6 — fixed in 0.3.6

How to fix

Upgrade to a fixed version: run-llama/llama_index 0.3.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-1752 or the next vulnerability affects your stack