{"data":{"id":"907c1b1a-d920-4b80-87a3-f5a929d3296d","title":"CVE-2024-58339: LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption…","summary":"LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation, tracked as CVE-2024-58339. The custom_query() function generates SQL from a user-supplied prompt and runs it through vn.run_sql() without enforcing query execution limits, so in deployments where untrusted users can supply prompts, an attacker can trigger expensive or unbounded SQL operations that exhaust CPU or memory and cause a denial-of-service condition.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-58339","publishedAt":"2026-01-13T04:15:51.630Z","cveId":"CVE-2024-58339","cweIds":["CWE-770"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["LlamaIndex"],"affectedVendorsRaw":["LlamaIndex","VannaPack","VannaQueryEngine"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LlamaIndex VannaQueryEngine uncontrolled resource consumption in custom_query","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00649,"epssCheckedAt":"2026-11-04T12:08:34.077Z","kevDateAdded":null,"advisoryAliases":["GHSA-h7v7-pr65-4w53"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T00:12:46.276Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"rag","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}