Vulnerability PYSEC-2026-1554
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 months ago
July 07, 2026 at 04:02 PM UTC
LlamaIndex Vulnerable to Denial of Service (DoS)
0.12.15 - 0.12.20
0.12.15 - 0.12.20
Summary
LlamaIndex Vulnerable to Denial of Service (DoS)
Details
A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_depth parameter in the get_article_urls function. This allows an attacker to exhaust Python's recursion limit through repeated function calls, leading to resource consumption and ultimately crashing the Python process.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class
0.4.4 - 0.12.40 PYSEC-2026-2606
0.4.4 - 0.12.40 PYSEC-2026-2606
High Risk
3 months ago
llama-index has Insecure Temporary File
0.4.4 - 0.12.52 PYSEC-2026-1556
0.4.4 - 0.12.52 PYSEC-2026-1556
High Risk
3 months ago
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
0.4.4 - 0.12.2 PYSEC-2026-1555
0.4.4 - 0.12.2 PYSEC-2026-1555
Critical
3 months ago
llama_index vulnerable to SQL Injection
0.4.4 - 0.12.27 PYSEC-2026-394
0.4.4 - 0.12.27 PYSEC-2026-394
High Risk
9 months ago
No summary available
0.4.4 - 0.11.6 PYSEC-2026-85
0.4.4 - 0.11.6 PYSEC-2026-85
Impacted packages
Timeline
Published
3 months ago
July 07, 2026 at 04:02 PM UTC
Fixed (0.12.21)
1 year ago
February 28, 2025 at 12:18 AM UTC
Last Modified
3 months ago
July 07, 2026 at 05:46 PM UTC