CVE-2024-58340
ReDoS Vulnerability in LangChain MRKLOutputParser Causes DoS
Publication date: 2026-01-12
Last updated on: 2026-01-12
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| langchain | langchain | to 0.3.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1333 | The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Regular Expression Denial of Service (ReDoS) in LangChain versions up to 0.3.1, specifically in the MRKLOutputParser.parse() method. The parser uses a backtracking-prone regular expression to extract tool actions from model output. An attacker who can supply or influence the parsed text, for example via prompt injection in applications that pass LLM output directly into this parser, can craft input that causes excessive CPU consumption. This leads to significant parsing delays and can cause a denial-of-service condition. [3]
How can this vulnerability impact me? :
If exploited, this vulnerability can cause excessive CPU usage on systems running vulnerable LangChain versions, leading to significant delays in parsing operations and potentially causing denial-of-service conditions. This means that applications relying on the MRKLOutputParser.parse() method may become unresponsive or slow, disrupting service availability. [3]