What’s Vulnerable › Vulnerabilities

CVE-2025-5302: Denial of Service (DOS) in JSONReader in run-llama/llama_index

• Severity: high (CVSS 8.6 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-25 · updated 2026-06-17
• Weakness: CWE-674

Description

A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth limit. This results in high resource consumption and potential crashes of the Python process. The issue is resolved in version 0.12.38.

Affected products

• run-llama/llama_index: before 0.12.38 — fixed in 0.12.38

How to fix

Upgrade to a fixed version: run-llama/llama_index 0.12.38. Check the vendor advisory for mitigations.

References

• https://github.com/run-llama/llama_index/commit/c032843a02ce38fd8f284b2aa5a37fd1c17ae635
• https://huntr.com/bounties/70041b81-de9e-4046-8c0e-6ccd557048a6

Get alerted when CVE-2025-5302 or the next vulnerability affects your stack