A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Physical

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00038.

Exploitation poc

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
langchain-ai langchain-ai/langchain affected
Version Status Constraints
unspecified affected < 0.2.5

Configuration 1 [-]

cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Langchain Subscribe
Langchain Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2024-0090 A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.
Github GHSA Github GHSA GHSA-3hjh-jh2h-vrg6 Denial of service in langchain-community
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/langchain-ai/langchain/commit/73c42306745b0831aa6fe7fe4eeb70d2c2d87a82 cve-icon cve-icon
https://huntr.com/bounties/90b0776d-9fa6-4841-aac4-09fde5918cae cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-2965 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-2965 cve-icon
History

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 5e-05}

 epss

{'score': 0.00014}

Thu, 19 Jun 2025 06:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 04 Nov 2024 08:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 03 Nov 2024 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Sun, 03 Nov 2024 17:15:00 +0000

Type Values Removed Values Added
Description A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-community` package, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality. A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.
Title Denial-of-Service in langchain-community SitemapLoader Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchain
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_0

{'score': 4.2, 'vector': 'CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Tue, 15 Oct 2024 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Langchain
Langchain langchain
Weaknesses CWE-674
CPEs cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*
Vendors & Products Langchain
Langchain langchain

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published:

Updated: 2025-10-15T12:50:22.559Z

Reserved: 2024-03-26T19:55:25.763Z

Link: CVE-2024-2965

cve-icon Vulnrichment

Updated: 2024-08-01T19:32:42.613Z

cve-icon NVD

Status : Modified

Published: 2024-06-06T19:15:55.897

Modified: 2024-11-21T09:10:56.847

Link: CVE-2024-2965

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-06-06T00:00:00Z

Links: CVE-2024-2965 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses