DoS vulnerability in llama_index langchain callback handler fixed
A denial-of-service vulnerability in run-llama/llama_index's langchain callback handler allowed attackers to cause indefinite hangs through the response generator. The issue was patched by adding a 120-second timeout to the get_response_gen method.
What happened
A denial-of-service vulnerability (CVE-2024-12704) was identified in the langchain callback handler component of run-llama/llama_index, specifically in the get_response_gen method.
The vulnerability allowed indefinite hangs in the response generation process due to lack of timeout protection.
Reported impact
The vulnerability could enable attackers to cause service disruption by triggering the response generator to hang indefinitely.
Index analysis
The get_response_gen method in llama_index/core/langchain_helpers/streaming.py was modified to add timeout protection with a default 120-second limit.
Governance controls
A timeout parameter was added to the get_response_gen method to prevent indefinite waits, and a small sleep interval (0.01 seconds) was introduced to prevent CPU spinning during idle loops.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.