PT-2025-26161 · Unknown · Llama-Index-Core+1

Published 2025-06-18 · Updated 2026-02-02 · CVE-2025-6208

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions llama index versions prior to 0.12.42 llama index.core versions prior to 0.12.42

Description The SimpleDirectoryReader component in llama index.core is subject to uncontrolled memory consumption due to a flaw in resource management. The num files limit parameter is applied after all files in a directory are loaded into memory, potentially leading to memory exhaustion and performance degradation, especially in resource-constrained environments.

Recommendations Update to version 0.12.42 or later. Update to version 0.12.41 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-6208

GHSA-488G-HW5F-X29P

Affected Products

Llama Index

Llama-Index-Core

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-6208 · Security Note
• https://osv.dev/vulnerability/GHSA-488g-hw5f-x29p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6208 · Vendor Advisory
• https://github.com/run-llama/llama_index · Note
• https://github.com/run-llama/llama_index/commit/53614e2f7913c0e86b58add9470b3c900b6c60b2 · Note
• https://twitter.com/_MrNiko/status/1944832870268461470 · Twitter Post
• https://t.me/CVEtracker/43491 · Telegram Post
• https://huntr.com/bounties/7d722bb6-6567-4608-8b23-f95048d7605a · Note
• https://twitter.com/_MrNiko/status/1935252140231925892 · Twitter Post