VULNERABILITY INTELLIGENCE

CVE-2024-1455

CVSS score5.9 MEDIUM
EPSS probability0.76%
CISA KEVNot currently listed
Published2024-03-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).

Weakness classification

  • security@huntr.dev: CWE-776

Primary references