MediumVulnerability
GHSA-3hjh-jh2h-vrg6: Denial of service in langchain-community
- Identifiers
- CVE-2024-2965GHSA-3hjh-jh2h-vrg6
- Published
- Record updated
- Affected
- langchain-community < 0.2.5
- langchain >= 0, < 0.2.5
- Fixed in
- 0.2.5
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
The `SitemapLoader` Document Loader in the `langchain-community` package, in versions below 0.2.5, has a denial of service flaw. The `parse_sitemap` method does not stop infinite recursion when a sitemap URL points back to the current sitemap, so it crashes the Python process by exceeding the maximum recursion depth. An attacker can occupy server socket/port resources, which impacts the availability of services that use this functionality.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- langchainPyPILLM dependency since 2022-10-25 · 30 tracked dependents
- langchain-communityPyPILLM dependency since 2023-12-08 · 27 tracked dependents
Related items
- HighCVE-2026-106119: LangChain MongoDBChatMessageHistory query injection via session identifierSame vendor · NVD/CVE Database
- LowGHSA-5x6v-p487-7qh2: LangChain: RediSearch Filter Injection via Unescaped Tag/Text ValuesSame vendor · GitHub Advisory Database
- HighGHSA-fvww-7h3r-vfhp: LangGraph SDK custom auth silently ignores actions= on resource decoratorsSame vendor · GitHub Advisory Database
- HighCVE-2026-72848: SitemapLoader nested sitemap entries bypass restrict_to_same_domainSame vendor · NVD/CVE Database
- HighGHSA-533j-2v4q-mw5h: LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposureSame vendor · GitHub Advisory Database