PT-2025-12140 · Run Llama · Llama Index

Published 2025-03-20 · Updated 2025-07-31 · CVE-2024-12704

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions run-llama/llama index version v0.12.5

Description A vulnerability in the LangChainLLM class allows for a Denial of Service (DoS) attack. The stream complete method executes the llm using a thread and retrieves the result via the get response gen method of the StreamingGeneratorCallbackHandler class. If the thread terminates abnormally before llm.predict is executed, there is no exception handling, leading to an infinite loop in the get response gen function. This can be triggered by providing an input of an incorrect type, causing the thread to terminate and the process to continue running indefinitely.

Recommendations For run-llama/llama index version v0.12.5, ensure that appropriate exception handling is implemented to manage thread terminations within the get response gen function to prevent infinite loops.

Exploit

Fix

DoS

Infinite Loop

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-835

CWE-755

Related Identifiers

CVE-2024-12704

GHSA-J3WR-M6XH-64HG

Affected Products

Llama Index

References · 8

• 🔥 https://huntr.com/bounties/a0b638fd-21c6-4ba7-b381-6ab98472a02a · Exploit
• https://github.com/run-llama/llama_index/commit/d1ecfb77578d089cbe66728f18f635c09aa32a05 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-12704 · Security Note
• https://osv.dev/vulnerability/GHSA-j3wr-m6xh-64hg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-12704 · Vendor Advisory
• https://github.com/run-llama/llama_index · Note
• https://t.me/cveNotify/130405 · Telegram Post
• https://twitter.com/CVEnew/status/1903082107473113448 · Twitter Post