Description
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_parser.py). The parser applies a backtracking-prone regular expression when extracting tool actions from model output. An attacker who can supply or influence the parsed text (for example via prompt injection in downstream applications that pass LLM output directly into MRKLOutputParser.parse()) can trigger excessive CPU consumption by providing a crafted payload, causing significant parsing delays and a denial-of-service condition.
INFO
Published Date :
2026-01-12T23:05:00.801Z
Last Modified :
2026-01-12T23:05:00.801Z
Source :
VulnCheck
AFFECTED PRODUCTS
The following products are affected by CVE-2024-58340 vulnerability.
| Vendors | Products |
|---|---|
| Langchain-ai |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2024-58340.
