CVE-2024-2965Medium· 4.2▾ SunlitDenial of service in langchain-community
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
0.3% → 0.3%
Denial of service in SitemapLoader Document Loader in the langchain-community package, affecting versions below 0.2.5. The parse_sitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.
langchain-community < 0.2.5langchain < 0.2.5Upgrade to a patched release:
langchain-community 0.2.5langchain 0.2.5Connected by shared product, vendor, weakness, or advisory.
CVE-2024-3095Medium· 4.8Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever
CVE-2024-5998Medium· 5.2LangChain pickle deserialization of untrusted data
CVE-2024-8309Medium· 4.9Langchain SQL Injection vulnerability
CVE-2025-6984High· 7.5Langchain Community Vulnerable to XML External Entity (XXE) Attacks