Llamaindex
CVE-2024-58339
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 14, 2026
Denial-of-service in LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 lets remote unauthenticated attackers exhaust CPU and memory through the VannaPack VannaQueryEngine. The engine's custom_query() converts a user-supplied natural-language prompt into SQL and runs it via vn.run_sql() with no execution limits, so a crafted prompt can produce an unbounded or extremely expensive query. Publicly available exploit code exists (Huntr bounty report), though EPSS is low at 0.12% (30th percentile) and it is not listed in CISA KEV.
Earlier versions of this analysis (1)
LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. [CVSS 7.5 HIGH]
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Llamaindex gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() logic generates SQL statements from a user-supplied prompt and executes them via vn.run_sql() without enforcing query execution limits In downstream deployments where untrusted users can supply prompts, an attacker can trigger expensive or unbounded SQL operations that exhaust CPU or memory resources, resulting in a denial-of-service condition. The vulnerable execution path occurs in llama_index/packs/vanna/base.py within custom_query().
Executive ViewAI
LlamaIndex (v0.12.2 and earlier) contains a denial-of-service vulnerability exploitable by unauthenticated actors via the VannaPack query engine, which could crash or significantly degrade AI and data-access applications built on this framework. Any organization relying on LlamaIndex for natural-language database interaction faces potential service outages and should prioritize patching.
Within 24 hours, inventory all internal applications using LlamaIndex and identify those with VannaPack VannaQueryEngine enabled; notify affected teams that publicly available exploit code exists. Within 7 days, apply the vendor-released patch to upgrade LlamaIndex beyond version 0.12.2 across all affected instances and validate functionality in staging. Within 30 days, conduct a full audit of LlamaIndex deployments to ensure all instances are patched and implement monitoring for abnormal resource consumption on patched systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Llamaindex
View allA SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specif
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for
SQL injection in llama_index DuckDB vector store v0.12.19. PoC and patch available.
Critical SQL injection vulnerability affecting run-llama/llama_index v0.12.21 and potentially other versions, present in
A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval func
LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, S
An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter
A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the
Arbitrary code execution in LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 occurs when BGEM3Inde
Local privilege escalation and denial of service in llama_index 0.12.33 arising from its default configuration of a worl
A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, a
A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_i
Exploit-DB