CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-1455

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).

Exploit prediction scoring system (EPSS) score

EPSS Score 0.008

EPSS Ranking 50.8%

CVSS Severity

CVSS v3 Score 5.9

References

Products affected by CVE-2024-1455

Langchain » Langchain » Version: 0.1.10

cpe:2.3:a:langchain:langchain:0.1.10
Langchain » Langchain » Version: 0.1.11

cpe:2.3:a:langchain:langchain:0.1.11
Langchain » Langchain » Version: 0.1.12

cpe:2.3:a:langchain:langchain:0.1.12
Langchain » Langchain » Version: 0.1.13

cpe:2.3:a:langchain:langchain:0.1.13
Langchain » Langchain » Version: 0.1.14

cpe:2.3:a:langchain:langchain:0.1.14
Langchain » Langchain » Version: 0.1.15

cpe:2.3:a:langchain:langchain:0.1.15
Langchain » Langchain » Version: 0.1.16

cpe:2.3:a:langchain:langchain:0.1.16
Langchain » Langchain » Version: 0.1.17

cpe:2.3:a:langchain:langchain:0.1.17
Langchain » Langchain » Version: 0.1.19

cpe:2.3:a:langchain:langchain:0.1.19
Langchain » Langchain » Version: 0.1.20

cpe:2.3:a:langchain:langchain:0.1.20
Langchain » Langchain » Version: 0.1.4

cpe:2.3:a:langchain:langchain:0.1.4
Langchain » Langchain » Version: 0.1.5

cpe:2.3:a:langchain:langchain:0.1.5
Langchain » Langchain » Version: 0.1.6

cpe:2.3:a:langchain:langchain:0.1.6
Langchain » Langchain » Version: 0.1.7

cpe:2.3:a:langchain:langchain:0.1.7
Langchain » Langchain » Version: 0.1.8

cpe:2.3:a:langchain:langchain:0.1.8
Langchain » Langchain » Version: 0.1.9

cpe:2.3:a:langchain:langchain:0.1.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-1455

Products

Pricing

Contact Us