PT-2025-26161 · Unknown · Llama-Index-Core+1

CVE-2025-6208 · Published 2025-06-18 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions llama index versions prior to 0.12.42 llama index.core versions prior to 0.12.42

Description The SimpleDirectoryReader component in llama index.core is subject to uncontrolled memory consumption due to a flaw in resource management. The num files limit parameter is applied after all files in a directory are loaded into memory, potentially leading to memory exhaustion and performance degradation, especially in resource-constrained environments.

Recommendations Update to version 0.12.42 or later. Update to version 0.12.41 or later.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-6208

GHSA-488G-HW5F-X29P

PYSEC-2026-1560

Affected Products

Llama Index

Llama-Index-Core

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6208.json · Exploit
• https://osv.dev/vulnerability/GHSA-488g-hw5f-x29p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6208 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-1560 · Vendor Advisory
• https://github.com/run-llama/llama_index · Note
• https://github.com/run-llama/llama_index/commit/53614e2f7913c0e86b58add9470b3c900b6c60b2 · Note
• https://huntr.com/bounties/7d722bb6-6567-4608-8b23-f95048d7605a · Note
• https://pypi.org/project/llama-index-core · Note
• https://t.me/CVEtracker/43491 · Telegram Post
• https://github.com/advisories/GHSA-488g-hw5f-x29p · Note
• https://twitter.com/_MrNiko/status/1935252140231925892 · Twitter Post
• https://twitter.com/_MrNiko/status/1944832870268461470 · Twitter Post