CVE-2024-1455: langchain — Exploit & Fix

Description

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS).

Is your site exposed to CVE-2024-1455?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-776 CWE-776

Affected Products

Vendor	Product	Versions
langchain	langchain	0.1.4 — 0.1.35

References

Advisories & Patches

https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3 https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3

Exploits

https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6 https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6

Frequently Asked Questions

What is CVE-2024-1455? +

A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS). It has a CVSS v3.1 base score of 5.9 (MEDIUM).

How severe is CVE-2024-1455? +

CVE-2024-1455 has a CVSS v3.1 score of 5.9 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-1455? +

CVE-2024-1455 affects products from langchain, specifically: langchain. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-1455? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-42212

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a …

CVE-2019-19144 9.8

XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate.

CVE-2026-31248 7.5

Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and validates XML …

CVE-2024-28757 7.5

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

CVE-2025-3225 7.5

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index …

CVE-2026-44020 7.5

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, …

CVE-2024-1455