CVE-2024-1455
Last modified
CVE-2024-1455 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS). EPSS estimates a 0.77% chance of exploitation in the next 30 days.
Description
A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Langchain | Langchain | >= 0.1.4, <= 0.1.35 |
References
- https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6Exploit, Third Party Advisory
- https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-1455?
How severe is CVE-2024-1455?
How do I fix CVE-2024-1455?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-1449The Master Slider – Responsive Touch Slider plugin for WordP…5.4
- CVE-2024-1450The Shariff Wrapper plugin for WordPress is vulnerable to St…5.4
- CVE-2024-1451An issue has been discovered in GitLab CE/EE affecting all v…8.7
- CVE-2024-1452The GenerateBlocks plugin for WordPress is vulnerable to Sen…4.3
- CVE-2024-1453 In Sante DICOM Viewer Pro versions 14.0.3 and prior, a user…7.8
- CVE-2024-1454The use-after-free vulnerability was found in the AuthentIC …3.4
- CVE-2024-1456An S3 bucket takeover vulnerability was identified in the h2…7.1
- CVE-2024-1457Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2024-1458The Elementor Addons by Livemesh plugin for WordPress is vul…5.4
- CVE-2024-1459A path traversal vulnerability was found in Undertow. This i…5.3
- CVE-2024-1460MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memor…4.4
- CVE-2024-1461The Elementor Addons by Livemesh plugin for WordPress is vul…5.4
Are you affected by CVE-2024-1455?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST