Executive Summary

This vulnerability is a Regular Expression Denial of Service (ReDoS) in LangChain versions up to 0.3.1, specifically in the MRKLOutputParser.parse() method. The parser uses a backtracking-prone regular expression to extract tool actions from model output. An attacker who can supply or influence the parsed text, for example via prompt injection in applications that pass LLM output directly into this parser, can craft input that causes excessive CPU consumption. This leads to significant parsing delays and can cause a denial-of-service condition. [3]

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can cause excessive CPU usage on systems running vulnerable LangChain versions, leading to significant delays in parsing operations and potentially causing denial-of-service conditions. This means that applications relying on the MRKLOutputParser.parse() method may become unresponsive or slow, disrupting service availability. [3]

Useful 0 Not Useful 0