CVE-2024-12910

What it actually does

The vulnerability permits an attacker to supply a root URL to the KnowledgeBaseWebReader class, triggering unbounded recursive invocations of get_article_urls that exhaust CPU and memory resources until the process terminates.

Why it matters to the business

Service outages or degraded performance occur in applications that ingest web content through the affected library, potentially disrupting dependent workflows and requiring emergency restarts or scaling.

How an attack unfolds

An attacker supplies a root URL value to the KnowledgeBaseWebReader constructor or equivalent entry point; the get_article_urls method then repeatedly follows links back to the same root domain, creating an infinite call stack that consumes all available system resources.

How to fix it

Upgrade run-llama/llama_index to commit 159ce485a1168100bb219dc1b93133f1121579d9 and the Kyverno 1.13 packages (kyverno, background-controller, cleanup-controller, cli, init-container, reports-controller) to version 1.13.2-r4 on both Chainguard and Wolfi distributions.

How to confirm the fix worked

Confirm the installed package versions match the listed fixed releases, then execute a test case that supplies a root URL and verify that recursion terminates with an explicit base-case guard rather than exhausting resources.

Typical attack path

1. Locate application code or configuration that instantiates KnowledgeBaseWebReader with a controllable URL parameter
2. Provide a root domain URL as input
3. Invoke the document loading or indexing operation that calls get_article_urls
4. Observe progressive resource consumption culminating in application crash or denial of service

How to detect it

Inspect application logs for repeated invocations of get_article_urls, correlate with sudden unbounded CPU or memory growth, and review any error or crash dumps that reference the KnowledgeBaseWebReader class.

What your security team should do

• Apply the listed fixed versions across all affected Kyverno and llama_index deployments without delay
• Audit source code for any direct or transitive use of KnowledgeBaseWebReader and enforce URL allow-listing or depth limits
• Add resource-usage monitoring and circuit breakers around document ingestion pipelines that rely on this library