What’s Vulnerable › Vulnerabilities

CVE-2025-21604: LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-06 · updated 2026-06-17
• Weakness: CWE-328

Description

LangChain4j-AIDeepin is a Retrieval enhancement generation (RAG) project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0.

Affected products

• moyangzhan langchain4j-aideepin: before 3.5.0

References

• https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a
• https://github.com/moyangzhan/langchain4j-aideepin/security/advisories/GHSA-cv5r-73vf-8x7v

Get alerted when CVE-2025-21604 or the next vulnerability affects your stack