Denial of Service Vulnerability in LangChainLLM Class of Run-Llama Repository
CVE-2024-12704
What is CVE-2024-12704?
A vulnerability exists in the LangChainLLM class of the run-llama/llama_index repository, specifically in version v0.12.5. The issue arises from the stream_complete method, which utilizes a thread to execute the llm and subsequently retrieves the results through the get_response_gen method of the StreamingGeneratorCallbackHandler class. If the thread experiences an abnormal termination before executing the _llm.predict method, it leads to a lack of exception handling, potentially causing the get_response_gen function to enter an infinite loop. This vulnerability can be exploited by supplying incorrect input types, leading to persistent denial of service.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
run-llama/llama_index < 0.12.6
References
CVSS V3.0
Timeline
Vulnerability published
Vulnerability Reserved