CVE-2024-1455: langchain-ai langchain-ai/langchain XML Entity Expansion
Vulnerability summary
CVE-2024-1455 is a medium (CVSS 5.9) XML Entity Expansion vulnerability in langchain-ai langchain-ai/langchain. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 26-03-2024PublishedVulnerability first disclosed.
- 15-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · PypiEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.76%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
-0.01 pp
From 0.77% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Langchain1 product
- langchain≥ 0.1.4, ≤ 0.1.35
Langchain-ai1 product
- langchain-ai/langchain≥ unspecified, < 0.1.35
PyPI1 product
- langchain-core< 0.1.35
3 vendors · 3 products
