LangChain
CVE-2024-58340
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remotely reachable via attacker-influenced parser input with no auth or interaction, and impact is availability-only through CPU-exhausting ReDoS, so C:N/I:N/A:H.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_parser.py). The parser applies a backtracking-prone regular expression when extracting tool actions from model output. An attacker who can supply or influence the parsed text (for example via prompt injection in downstream applications that pass LLM output directly into MRKLOutputParser.parse()) can trigger excessive CPU consumption by providing a crafted payload, causing significant parsing delays and a denial-of-service condition.
AnalysisAI
Denial-of-service in LangChain versions up to and including 0.3.1 lets remote attackers exhaust CPU by feeding a crafted string into the MRKLOutputParser.parse() method, whose backtracking-prone regular expression exhibits catastrophic backtracking (ReDoS). Because MRKL agents parse LLM output to extract tool actions, an attacker who can influence that text - typically via prompt injection in downstream applications - can stall or hang the parsing thread. Publicly available exploit code exists (huntr bounty), though EPSS is low at 0.08% and it is not on the CISA KEV list.
Technical ContextAI
The affected component is LangChain's MRKL (Modular Reasoning, Knowledge and Language) agent output parser, libs/langchain/langchain/agents/mrkl/output_parser.py, which turns free-form LLM text into structured Action/Action Input tool invocations. The root cause is CWE-1333 (Inefficient Regular Expression Complexity): the parser uses a regex whose structure permits catastrophic backtracking, so a specially shaped input causes the regex engine's matching time to grow super-linearly. The affected CPE is cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*, the Python langchain package. The exposure exists specifically where application code passes untrusted or model-generated text directly into MRKLOutputParser.parse(), which is common in agentic pipelines that route tool-using LLM responses through this parser.
RemediationAI
Patch available per vendor advisory: upgrade LangChain to a version later than 0.3.1 that hardens the MRKL parser regex (confirm the exact fixed release against the VulnCheck advisory at https://www.vulncheck.com/advisories/langchain-mrkloutputparser-redos and the upstream repository https://github.com/langchain-ai/langchain before deploying, as no specific fixed version number was provided in this input). If immediate upgrade is not possible, reduce exposure by not passing untrusted or raw LLM output directly into MRKLOutputParser.parse(): impose a strict length cap on text handed to the parser (catastrophic backtracking requires a sizeable crafted payload, so bounding input length blunts the attack at the cost of truncating very long legitimate agent outputs), enforce a wall-clock timeout or run parsing in a separate worker/thread that can be killed so a hung regex cannot block the main service, and add input sanitization or prompt-injection defenses upstream to limit an attacker's ability to shape parsed text. Consider migrating off the MRKL agent to a structured/JSON tool-calling agent that does not rely on regex parsing of free-form output.
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in
A remote code execution vulnerability in langchain-ai/langchain (CVSS 10.0). Risk factors: public PoC available. Vendor
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this cl
A vulnerability was found in LangChain langchain_community 0.0.26. Rated critical severity (CVSS 9.8), this vulnerabilit
An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function
An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. Rated
An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted
An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the fro
An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. Rated criti
An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Pyth
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today