{"data":{"id":"b3e62ff6-d878-45ef-beec-dbf63feb2d96","title":"CVE-2026-14742: A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function _freeze of…","summary":"A flaw was found in langchain-ai langgraph up to 1.2.4. The _freeze function in libs/langgraph/langgraph/_internal/_cache.py, part of the Task Result Cache component, uses a weak hash when handling the default_cache_key argument. The attack can be carried out remotely, but its complexity is rather high and exploitability is described as difficult. A public exploit exists.","solution":"The pull request to fix this issue awaits acceptance.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14742","publishedAt":"2026-07-05T11:16:27.390Z","cveId":"CVE-2026-14742","cweIds":["CWE-327","CWE-328"],"cvssScore":"3.1","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangGraph"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langchain-ai langgraph Task Result Cache weak hash via default_cache_key","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00233,"epssCheckedAt":"2026-10-14T12:12:43.552Z","kevDateAdded":null,"advisoryAliases":["GHSA-rff8-98wf-8rv4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:47:02.955Z","patchAvailable":null,"disclosureDate":"2026-07-05T11:16:27.390Z","capecIds":["CAPEC-20"],"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}