{"data":{"id":"546ac1c0-b4f3-4bd1-927c-5c4e253e348c","title":"CVE-2024-12704: A vulnerability in the LangChainLLM class of the run-llama/llama_index repository, version v0.12.5, allows for a Denial…","summary":"CVE-2024-12704 affects the LangChainLLM class in the run-llama/llama_index repository, version v0.12.5. The stream_complete method runs the llm in a thread and reads the result through get_response_gen of StreamingGeneratorCallbackHandler. If the thread terminates abnormally before _llm.predict executes, get_response_gen enters an infinite loop because no exception handling covers this case. Providing an input of an incorrect type triggers this, enabling a Denial of Service (DoS) attack.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-12704","publishedAt":"2025-03-20T14:15:29.383Z","cveId":"CVE-2024-12704","cweIds":["CWE-835"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["llama-index-core@< 0.12.6 (fixed: 0.12.6)"],"affectedPackageNames":["llama-index-core"],"affectedPackageRefs":["pypi:llama-index-core"],"affectedVendors":[],"affectedVendorsRaw":["LlamaIndex","LangChain"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LangChainLLM denial of service through infinite loop in stream_complete","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00831,"epssCheckedAt":"2026-11-04T06:10:14.970Z","kevDateAdded":null,"advisoryAliases":["GHSA-j3wr-m6xh-64hg"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:17.607Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-12-17T22:44:20.477Z","daysToFix":-93,"fixCheckedAt":"2026-10-29T21:44:55.379Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"llama-index-core","fixedVersion":"0.12.6","matchedVersion":"0.12.6","fixReleasedAt":"2024-12-17T22:44:20.477Z","daysToFix":-93,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:55.228Z"}]}}