Cloudanix VulnDB

CVE-2024-2965

Medium · 4.2

CVSS

4.2

EPSS

0.3%

Published

Jun 6, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A software library used to read website maps can be tricked into looping endlessly on a single file, causing the program to crash and interrupting any service that relies on it.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
High
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The parse_sitemap method in SitemapLoader lacks recursion guards, allowing a sitemap URL to reference itself and trigger unbounded Python recursion that exhausts the call stack and terminates the process.

Why it matters to the business

Services built on the affected library can be made unavailable by a remote crash that consumes socket resources and forces restarts, interrupting dependent AI or data-processing workflows until the instance is recovered.

How an attack unfolds

An attacker supplies a crafted sitemap URL that points back to itself; when the vulnerable loader begins parsing, each recursive call follows the same self-reference, rapidly exceeding Python's recursion limit and crashing the process.

How to fix it

Upgrade the langchain package to the commit fbeeb6da7512837f43aff415c01ee3bf8a672aeb or later; if a direct upgrade is not feasible, wrap the sitemap loader with an explicit recursion-depth guard or disable sitemap ingestion for untrusted sources.

How to confirm the fix worked

Confirm the installed commit hash is at or beyond fbeeb6da7512837f43aff415c01ee3bf8a672aeb, then attempt to parse a self-referential sitemap in a controlled environment and verify the call is rejected before recursion limits are reached.

Typical attack path

  1. Locate an application or service that invokes SitemapLoader.parse_sitemap with untrusted input
  2. Host or reference a sitemap whose loc element points to its own URL
  3. Trigger the loader through normal application input paths
  4. Observe the resulting RecursionError and process termination

How to detect it

Search application and system logs for uncaught RecursionError exceptions that occur during sitemap parsing; correlate with inbound requests containing sitemap URLs that match the host's own domain.

  • RecursionError: maximum recursion depth exceeded while calling a Python object
  • parse_sitemap
  • SitemapLoader

What your security team should do

  • Immediately update to the fixed commit in all environments that consume langchain-community
  • Add runtime monitoring for Python RecursionError events tied to sitemap processing
  • Restrict SitemapLoader to trusted domains until patching is complete

The record

A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-community` package, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.

Affected packages

Ecosystem Package Introduced Fixed
PyPI langchain 0 73c42306745b0831aa6fe7fe4eeb70d2c2d87a82
PyPI langchain 0 0.2.5
PyPI langchain-community 0 0.2.5

Related vulnerabilities