CVE-2024-2965: langchain-ai langchain-ai/langchain Uncontrolled Recursion
Vulnerability summary
CVE-2024-2965 is a medium (CVSS 4.7) Uncontrolled Recursion vulnerability in langchain-ai langchain-ai/langchain. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 06-06-2024PublishedVulnerability first disclosed.
- 15-10-2025Last modifiedVulnerability information updated.
Description
A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · PypiEcosystem advisory · calculated4.2MediumCVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST4.2MediumCVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
0.00 pp
From 0.30% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
PyPI2 products
- langchain< 73c42306745b0831aa6fe7fe4eeb70d2c2d87a82 | < 0.2.5
- langchain-community< 0.2.5
Langchain1 product
- langchain< 0.2.5
Langchain-ai1 product
- langchain-ai/langchain≥ unspecified, < 0.2.5
3 vendors · 4 products
