{"data":{"id":"782033d4-5b70-456e-a296-8286fec016eb","title":"GHSA-3hjh-jh2h-vrg6: Denial of service in langchain-community","summary":"The `SitemapLoader` Document Loader in the `langchain-community` package, in versions below 0.2.5, has a denial of service flaw. The `parse_sitemap` method does not stop infinite recursion when a sitemap URL points back to the current sitemap, so it crashes the Python process by exceeding the maximum recursion depth. An attacker can occupy server socket/port resources, which impacts the availability of services that use this functionality.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-3hjh-jh2h-vrg6","publishedAt":"2024-06-06T21:30:36.000Z","cveId":"CVE-2024-2965","cweIds":["CWE-400","CWE-674"],"cvssScore":"4.2","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["langchain-community@< 0.2.5 (fixed: 0.2.5)","langchain@>= 0, < 0.2.5 (fixed: 0.2.5)"],"affectedPackageNames":["langchain-community","langchain"],"affectedPackageRefs":["pypi:langchain-community","pypi:langchain"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["langchain-community","SitemapLoader"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"physical","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00304,"epssCheckedAt":"2026-10-10T04:57:07.446Z","kevDateAdded":null,"advisoryAliases":["GHSA-3hjh-jh2h-vrg6"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2024-06-06T21:30:36.000Z","capecIds":["CAPEC-125","CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}