Vulnerability Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37183?format=api",
    "vulnerability_id": "VCID-f71e-h861-6qh6",
    "summary": "LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_parser.py). The parser applies a backtracking-prone regular expression when extracting tool actions from model output. An attacker who can supply or influence the parsed text (for example via prompt injection in downstream applications that pass LLM output directly into MRKLOutputParser.parse()) can trigger excessive CPU consumption by providing a crafted payload, causing significant parsing delays and a denial-of-service condition.",
    "aliases": [
        {
            "alias": "CVE-2024-58340"
        },
        {
            "alias": "PYSEC-2026-75"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/47086?format=api",
            "purl": "pkg:pypi/langchain-exa@1.0.0a1",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/langchain-exa@1.0.0a1"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/40197?format=api",
            "purl": "pkg:pypi/langchain-exa@0.0.1",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-f71e-h861-6qh6"
                },
                {
                    "vulnerability": "VCID-u29a-rxyq-aubh"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/langchain-exa@0.0.1"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/40198?format=api",
            "purl": "pkg:pypi/langchain-exa@0.1.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-f71e-h861-6qh6"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/langchain-exa@0.1.0"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/47082?format=api",
            "purl": "pkg:pypi/langchain-exa@0.2.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-f71e-h861-6qh6"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/langchain-exa@0.2.0"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/47083?format=api",
            "purl": "pkg:pypi/langchain-exa@0.2.1",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-f71e-h861-6qh6"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/langchain-exa@0.2.1"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/47084?format=api",
            "purl": "pkg:pypi/langchain-exa@0.3.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-f71e-h861-6qh6"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/langchain-exa@0.3.0"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/47085?format=api",
            "purl": "pkg:pypi/langchain-exa@0.3.1",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-f71e-h861-6qh6"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/langchain-exa@0.3.1"
        }
    ],
    "references": [
        {
            "reference_url": "https://github.com/langchain-ai/langchain",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "7.5",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                }
            ],
            "url": "https://github.com/langchain-ai/langchain"
        },
        {
            "reference_url": "https://huntr.com/bounties/e7ece02c-d4bb-4166-8e08-6baf4f8845bb",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "7.5",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                }
            ],
            "url": "https://huntr.com/bounties/e7ece02c-d4bb-4166-8e08-6baf4f8845bb"
        },
        {
            "reference_url": "https://www.langchain.com/",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "7.5",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                }
            ],
            "url": "https://www.langchain.com/"
        },
        {
            "reference_url": "https://www.vulncheck.com/advisories/langchain-mrkloutputparser-redos",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "7.5",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                }
            ],
            "url": "https://www.vulncheck.com/advisories/langchain-mrkloutputparser-redos"
        }
    ],
    "weaknesses": [],
    "exploits": [],
    "severity_range_score": "7.5 - 7.5",
    "exploitability": null,
    "weighted_severity": null,
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-f71e-h861-6qh6"
}