CVE-2024-58340: LangChain <= 0.3.1 MRKLOutputParser ReDoS
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/outputparser.py). The parser applies a backtracking-prone regular expression when extracting tool actions from model output. An attacker who can supply or influence the parsed text (for example via prompt injection in downstream applications that pass LLM output directly into MRKLOutputParser.parse()) can trigger excessive CPU consumption by providing a crafted payload, causing significant parsing delays and a denial-of-service condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LangChain (MRKLOutputParser / output_parser.py)to a version that resolves this vulnerability.Fixed in 0.3.1 - Compensating control
Protect the service that calls MRKLOutputParser.parse() by limiting the maximum size/complexity of model output that can be parsed (e.g., cap output length and/or enforce timeouts) to prevent CPU-exhaustion parsing DoS from crafted payloads.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58340?
CVE-2024-58340 is categorized as a medium severity vulnerability due to its potential for exploitation through regular expression denial of service.
How do I fix CVE-2024-58340?
To mitigate CVE-2024-58340, you should upgrade LangChain to version 0.3.2 or later, where the vulnerability has been addressed.
What software is affected by CVE-2024-58340?
CVE-2024-58340 affects all versions of LangChain up to and including 0.3.1.
What type of vulnerability is CVE-2024-58340?
CVE-2024-58340 is a regular expression denial-of-service (ReDoS) vulnerability.
Where can I find more information about CVE-2024-58340?
You can find additional details about CVE-2024-58340 in LangChain documentation and security advisories.