{"id":"CVE-2024-2965","aliases":["EUVD-2024-0090","GHSA-3hjh-jh2h-vrg6","PYSEC-2024-118","PYSEC-2026-2561"],"status":"published","title":"Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchain","description":"A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.","severity":{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00304,"percentile":0.23335,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-674"],"published":"2024-06-06T18:52:54Z","modified":"2026-10-28T02:30:28Z","fixes":[{"ecosystem":"PyPI","package":"langchain-community","fixed_in":["0.2.5"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"langchain","fixed_in":["0.2.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"langchain-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"langchain","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"langchain-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.1rc1","0.0.1rc2","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.30","0.0.31","0.0.32","0.0.33","0.0.34","0.0.35","0.0.36","0.0.37","0.0.38","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.2.0","0.2.0rc1","0.2.1","0.2.2","0.2.3","0.2.4"]},{"source":"osv","ecosystem":"PyPI","package":"langchain","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}],"versions":["0.0.1","0.0.10","0.0.100","0.0.101","0.0.101rc0","0.0.102","0.0.102rc0","0.0.103","0.0.104","0.0.105","0.0.106","0.0.107","0.0.108","0.0.109","0.0.11","0.0.110","0.0.111","0.0.112","0.0.113","0.0.114","0.0.115","0.0.116","0.0.117","0.0.118","0.0.119","0.0.12","0.0.120","0.0.121","0.0.122","0.0.123","0.0.124","0.0.125","0.0.126","0.0.127","0.0.128","0.0.129","0.0.13","0.0.130","0.0.131","0.0.132","0.0.133","0.0.134","0.0.135","0.0.136","0.0.137","0.0.138","0.0.139","0.0.14","0.0.140","0.0.141","0.0.142","0.0.143","0.0.144","0.0.145","0.0.146","0.0.147","0.0.148","0.0.149","0.0.15","0.0.150","0.0.151","0.0.152","0.0.153","0.0.154","0.0.155","0.0.156","0.0.157","0.0.158","0.0.159","0.0.16","0.0.160","0.0.161","0.0.162","0.0.163","0.0.164","0.0.165","0.0.166","0.0.167","0.0.168","0.0.169","0.0.17","0.0.170","0.0.171","0.0.172","0.0.173","0.0.174","0.0.175","0.0.176","0.0.177","0.0.178","0.0.179","0.0.18","0.0.180","0.0.181","0.0.182","0.0.183","0.0.184","0.0.185","0.0.186","0.0.187","0.0.188","0.0.189","0.0.19","0.0.190","0.0.191","0.0.192","0.0.193","0.0.194","0.0.195","0.0.196","0.0.197","0.0.198","0.0.199","0.0.2","0.0.20","0.0.200","0.0.201","0.0.202","0.0.203","0.0.204","0.0.205","0.0.206","0.0.207","0.0.208","0.0.209","0.0.21","0.0.210","0.0.211","0.0.212","0.0.213","0.0.214","0.0.215","0.0.216","0.0.217","0.0.218","0.0.219","0.0.22","0.0.220","0.0.221","0.0.222","0.0.223","0.0.224","0.0.225","0.0.226","0.0.227","0.0.228","0.0.229","0.0.23","0.0.230","0.0.231","0.0.232","0.0.233","0.0.234","0.0.235","0.0.236","0.0.237","0.0.238","0.0.239","0.0.24","0.0.240","0.0.240rc0","0.0.240rc1","0.0.240rc4","0.0.242","0.0.243","0.0.244","0.0.245","0.0.246","0.0.247","0.0.248","0.0.249","0.0.25","0.0.250","0.0.251","0.0.252","0.0.253","0.0.254","0.0.255","0.0.256","0.0.257","0.0.258","0.0.259","0.0.26","0.0.260","0.0.261","0.0.262","0.0.263","0.0.264","0.0.265","0.0.266","0.0.267","0.0.268","0.0.269","0.0.27","0.0.270","0.0.271","0.0.272","0.0.273","0.0.274","0.0.275","0.0.276","0.0.277","0.0.278","0.0.279","0.0.28","0.0.281","0.0.283","0.0.284","0.0.285","0.0.286","0.0.287","0.0.288","0.0.289","0.0.29","0.0.290","0.0.291","0.0.292","0.0.293","0.0.294","0.0.295","0.0.296","0.0.297","0.0.298","0.0.299","0.0.3","0.0.30","0.0.300","0.0.301","0.0.302","0.0.303","0.0.304","0.0.305","0.0.306","0.0.307","0.0.308","0.0.309","0.0.31","0.0.310","0.0.311","0.0.312","0.0.313","0.0.314","0.0.315","0.0.316","0.0.317","0.0.318","0.0.319","0.0.32","0.0.320","0.0.321","0.0.322","0.0.323","0.0.324","0.0.325","0.0.326","0.0.327","0.0.329","0.0.33","0.0.330","0.0.331","0.0.331rc0","0.0.331rc1","0.0.331rc2","0.0.331rc3","0.0.332","0.0.333","0.0.334","0.0.335","0.0.336","0.0.337","0.0.338","0.0.339","0.0.339rc0","0.0.339rc1","0.0.339rc2","0.0.339rc3","0.0.34","0.0.340","0.0.341","0.0.342","0.0.343","0.0.344","0.0.345","0.0.346","0.0.347","0.0.348","0.0.349","0.0.349rc1","0.0.349rc2","0.0.35","0.0.350","0.0.351","0.0.352","0.0.353","0.0.354","0.0.36","0.0.37","0.0.38","0.0.39","0.0.4","0.0.40","0.0.41","0.0.42","0.0.43","0.0.44","0.0.45","0.0.46","0.0.47","0.0.48","0.0.49","0.0.5","0.0.50","0.0.51","0.0.52","0.0.53","0.0.54","0.0.55","0.0.56","0.0.57","0.0.58","0.0.59","0.0.6","0.0.60","0.0.61","0.0.63","0.0.64","0.0.65","0.0.66","0.0.67","0.0.68","0.0.69","0.0.7","0.0.70","0.0.71","0.0.72","0.0.73","0.0.74","0.0.75","0.0.76","0.0.77","0.0.78","0.0.79","0.0.8","0.0.80","0.0.81","0.0.82","0.0.83","0.0.84","0.0.85","0.0.86","0.0.87","0.0.88","0.0.89","0.0.9","0.0.90","0.0.91","0.0.92","0.0.93","0.0.94","0.0.95","0.0.96","0.0.97","0.0.98","0.0.99","0.0.99rc0","0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.17rc1","0.1.19","0.1.2","0.1.20","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.0rc1","0.2.0rc2","0.2.1","0.2.2","0.2.3","0.2.4"]},{"source":"osv","ecosystem":"PyPI","package":"langchain","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"73c42306745b0831aa6fe7fe4eeb70d2c2d87a82"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}],"versions":["0.0.1","0.0.10","0.0.100","0.0.101","0.0.101rc0","0.0.102","0.0.102rc0","0.0.103","0.0.104","0.0.105","0.0.106","0.0.107","0.0.108","0.0.109","0.0.11","0.0.110","0.0.111","0.0.112","0.0.113","0.0.114","0.0.115","0.0.116","0.0.117","0.0.118","0.0.119","0.0.12","0.0.120","0.0.121","0.0.122","0.0.123","0.0.124","0.0.125","0.0.126","0.0.127","0.0.128","0.0.129","0.0.13","0.0.130","0.0.131","0.0.132","0.0.133","0.0.134","0.0.135","0.0.136","0.0.137","0.0.138","0.0.139","0.0.14","0.0.140","0.0.141","0.0.142","0.0.143","0.0.144","0.0.145","0.0.146","0.0.147","0.0.148","0.0.149","0.0.15","0.0.150","0.0.151","0.0.152","0.0.153","0.0.154","0.0.155","0.0.156","0.0.157","0.0.158","0.0.159","0.0.16","0.0.160","0.0.161","0.0.162","0.0.163","0.0.164","0.0.165","0.0.166","0.0.167","0.0.168","0.0.169","0.0.17","0.0.170","0.0.171","0.0.172","0.0.173","0.0.174","0.0.175","0.0.176","0.0.177","0.0.178","0.0.179","0.0.18","0.0.180","0.0.181","0.0.182","0.0.183","0.0.184","0.0.185","0.0.186","0.0.187","0.0.188","0.0.189","0.0.19","0.0.190","0.0.191","0.0.192","0.0.193","0.0.194","0.0.195","0.0.196","0.0.197","0.0.198","0.0.199","0.0.2","0.0.20","0.0.200","0.0.201","0.0.202","0.0.203","0.0.204","0.0.205","0.0.206","0.0.207","0.0.208","0.0.209","0.0.21","0.0.210","0.0.211","0.0.212","0.0.213","0.0.214","0.0.215","0.0.216","0.0.217","0.0.218","0.0.219","0.0.22","0.0.220","0.0.221","0.0.222","0.0.223","0.0.224","0.0.225","0.0.226","0.0.227","0.0.228","0.0.229","0.0.23","0.0.230","0.0.231","0.0.232","0.0.233","0.0.234","0.0.235","0.0.236","0.0.237","0.0.238","0.0.239","0.0.24","0.0.240","0.0.240rc0","0.0.240rc1","0.0.240rc4","0.0.242","0.0.243","0.0.244","0.0.245","0.0.246","0.0.247","0.0.248","0.0.249","0.0.25","0.0.250","0.0.251","0.0.252","0.0.253","0.0.254","0.0.255","0.0.256","0.0.257","0.0.258","0.0.259","0.0.26","0.0.260","0.0.261","0.0.262","0.0.263","0.0.264","0.0.265","0.0.266","0.0.267","0.0.268","0.0.269","0.0.27","0.0.270","0.0.271","0.0.272","0.0.273","0.0.274","0.0.275","0.0.276","0.0.277","0.0.278","0.0.279","0.0.28","0.0.281","0.0.283","0.0.284","0.0.285","0.0.286","0.0.287","0.0.288","0.0.289","0.0.29","0.0.290","0.0.291","0.0.292","0.0.293","0.0.294","0.0.295","0.0.296","0.0.297","0.0.298","0.0.299","0.0.3","0.0.30","0.0.300","0.0.301","0.0.302","0.0.303","0.0.304","0.0.305","0.0.306","0.0.307","0.0.308","0.0.309","0.0.31","0.0.310","0.0.311","0.0.312","0.0.313","0.0.314","0.0.315","0.0.316","0.0.317","0.0.318","0.0.319","0.0.32","0.0.320","0.0.321","0.0.322","0.0.323","0.0.324","0.0.325","0.0.326","0.0.327","0.0.329","0.0.33","0.0.330","0.0.331","0.0.331rc0","0.0.331rc1","0.0.331rc2","0.0.331rc3","0.0.332","0.0.333","0.0.334","0.0.335","0.0.336","0.0.337","0.0.338","0.0.339","0.0.339rc0","0.0.339rc1","0.0.339rc2","0.0.339rc3","0.0.34","0.0.340","0.0.341","0.0.342","0.0.343","0.0.344","0.0.345","0.0.346","0.0.347","0.0.348","0.0.349","0.0.349rc1","0.0.349rc2","0.0.35","0.0.350","0.0.351","0.0.352","0.0.353","0.0.354","0.0.36","0.0.37","0.0.38","0.0.39","0.0.4","0.0.40","0.0.41","0.0.42","0.0.43","0.0.44","0.0.45","0.0.46","0.0.47","0.0.48","0.0.49","0.0.5","0.0.50","0.0.51","0.0.52","0.0.53","0.0.54","0.0.55","0.0.56","0.0.57","0.0.58","0.0.59","0.0.6","0.0.60","0.0.61","0.0.63","0.0.64","0.0.65","0.0.66","0.0.67","0.0.68","0.0.69","0.0.7","0.0.70","0.0.71","0.0.72","0.0.73","0.0.74","0.0.75","0.0.76","0.0.77","0.0.78","0.0.79","0.0.8","0.0.80","0.0.81","0.0.82","0.0.83","0.0.84","0.0.85","0.0.86","0.0.87","0.0.88","0.0.89","0.0.9","0.0.90","0.0.91","0.0.92","0.0.93","0.0.94","0.0.95","0.0.96","0.0.97","0.0.98","0.0.99","0.0.99rc0","0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.17rc1","0.1.19","0.1.2","0.1.20","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.0rc1","0.2.0rc2","0.2.1","0.2.2","0.2.3","0.2.4","v0.1.16","v0.1.15","v0.1.14","v0.1.13","v0.1.12","v0.1.11","v0.1.10","v0.1.9","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0","v0.0.354","v0.0.353","v0.0.352","v0.0.351","v0.0.350","v0.0.349","v0.0.349-rc.2","v0.0.349-rc.1","v0.0.347","v0.0.348","v0.0.346","v0.0.345","v0.0.344","v0.0.343","v0.0.342","v0.0.341","v0.0.339rc3","v0.0.339rc2","v0.0.340","v0.0.339","v0.0.339rc1","v0.0.339rc0","v0.0.338","v0.0.337","v0.0.336","v0.0.335","v0.0.334","v0.0.333","v0.0.332","v0.0.331rc3","v0.0.331rc2","v0.0.331rc1","v0.0.331rc0","v0.0.331","v0.0.330","v0.0.329","v0.0.327","v0.0.326","v0.0.325","v0.0.324","v0.0.323","v0.0.322","v0.0.321","v0.0.320","v0.0.319","v0.0.318","v0.0.317","v0.0.316","v0.0.315","v0.0.314","v0.0.313","v0.0.312","v0.0.311","v0.0.310","v0.0.309","v0.0.308","v0.0.307","v0.0.306","v0.0.305","v0.0.304","v0.0.303","v0.0.302","v0.0.301","v0.0.298","v0.0.300","v0.0.299","v0.0.297","v0.0.296","v0.0.295","v0.0.294","v0.0.293","v0.0.292","v0.0.291","v0.0.290","v0.0.289","v0.0.288","v0.0.287","v0.0.286","v0.0.285","v0.0.284","v0.0.283","v0.0.281","v0.0.279","v0.0.278","v0.0.277","v0.0.276","v0.0.275","v0.0.274","v0.0.273","v0.0.272","v0.0.271","v0.0.270","v0.0.269","v0.0.268","v0.0.267","v0.0.266","v0.0.265","v0.0.264","v0.0.263","v0.0.262","v0.0.261","v0.0.260","v0.0.259","v0.0.258","v0.0.257","v0.0.256","v0.0.255","v0.0.254","v0.0.253","v0.0.252","v0.0.251","v0.0.250","v0.0.249","v0.0.248","v0.0.247","v0.0.245","v0.0.5","v0.0.244","v0.0.4","v0.0.243","v0.0.242","v0.0.2","v0.0.240","v0.0.1","v0.0.240rc4","v0.0.1rc4","v0.0.240rc1","v0.0.240rc0","v0.0.1rc3","v0.0.1rc2","v0.0.1rc1","v0.0.1rc0","v0.0.239","v0.0.238","v0.0.237","v0.0.236","v0.0.235","v0.0.234","v0.0.233","v0.0.232","v0.0.231","v0.0.230","v0.0.229","v0.0.228","v0.0.227","v0.0.226","v0.0.225","v0.0.224","v0.0.223","v0.0.222","v0.0.221","v0.0.220","v0.0.219","v0.0.218","v0.0.217","v0.0.216","v0.0.215","v0.0.214","v0.0.213","v0.0.212","v0.0.211","v0.0.210","v0.0.209","v0.0.208","v0.0.207","v0.0.206","v0.0.205","v0.0.204","v0.0.202","v0.0.201","v0.0.200","v0.0.199","v0.0.198","v0.0.197","v0.0.196","v0.0.195","v0.0.194","v0.0.193","v0.0.192","v0.0.191","v0.0.190","v0.0.189","v0.0.188","v0.0.187","v0.0.186","v0.0.185","v0.0.184","v0.0.183","v0.0.182","v0.0.181","v0.0.180","v0.0.179","v0.0.178","v0.0.177","v0.0.175","v0.0.174","v0.0.173","v0.0.172","v0.0.171","v0.0.170","v0.0.169","v0.0.168","v0.0.167","v0.0.166","v0.0.165","v0.0.164","v0.0.163","v0.0.161","v0.0.162","v0.0.160","v0.0.159","v0.0.158","v0.0.157","v0.0.156","v0.0.155","v0.0.154","v0.0.153","v0.0.152","v0.0.151","v0.0.150","v0.0.149","v0.0.147","v0.0.146","v0.0.145","v0.0.144","v0.0.143","v0.0.142","v0.0.141","v0.0.140","v0.0.139","v0.0.138","v0.0.137","v0.0.136","v0.0.135","v0.0.134","v0.0.133","v0.0.132","v0.0.131","v0.0.130","v0.0.129","v0.0.128","v0.0.127","v0.0.126","v0.0.125","v0.0.124","v0.0.123","v0.0.122","v0.0.121","v0.0.120","v0.0.119","v0.0.118","v0.0.117","v0.0.116","v0.0.115","v0.0.114","v0.0.113","v0.0.112","v0.0.111","v0.0.110","v0.0.109","v0.0.108","v0.0.107","v0.0.106","v0.0.105","v0.0.104","v0.0.103","v0.0.102","v0.0.101","v0.0.100","v0.0.99","v0.0.98","v0.0.97","v0.0.96","v0.0.95","v0.0.94","v0.0.93","v0.0.92","v0.0.91","v0.0.90","v0.0.89","v0.0.88","v0.0.87","v0.0.86","v0.0.85","v0.0.84","v0.0.83","v0.0.82","v0.0.81","v0.0.80","v0.0.79","v0.0.78","v0.0.77","v0.0.76","v0.0.75","v0.0.74","v0.0.73","v0.0.72","v0.0.71","v0.0.70","v0.0.69","v0.0.68","v0.0.67","v0.0.66","v0.0.65","v0.0.64"]},{"source":"osv","ecosystem":"PyPI","package":"langchain-community","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.1rc1","0.0.1rc2","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.30","0.0.31","0.0.32","0.0.33","0.0.34","0.0.35","0.0.36","0.0.37","0.0.38","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.2.0","0.2.0rc1","0.2.1","0.2.2","0.2.3","0.2.4"]}],"products":[{"vendor":"langchain","product":"langchain"},{"vendor":"langchain-ai","product":"langchain-ai/langchain"}],"references":[{"url":"https://huntr.com/bounties/90b0776d-9fa6-4841-aac4-09fde5918cae","tags":["x_transferred","Exploit","Third Party Advisory","web","evidence"]},{"url":"https://github.com/langchain-ai/langchain/commit/73c42306745b0831aa6fe7fe4eeb70d2c2d87a82","tags":["fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2965","tags":["advisory"]},{"url":"https://github.com/langchain-ai/langchain/pull/22903","tags":["web"]},{"url":"https://github.com/langchain-ai/langchain/commit/9a877c7adbd06f90a2518152f65b562bd90487cc","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-118.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3hjh-jh2h-vrg6","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2965.json","tags":["advisory"]},{"url":"https://github.com/langchain-ai/langchain","tags":["package"]},{"url":"https://pypi.org/project/langchain-community","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-2965","title":"Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchain","description":"A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.","status":"published","published":"2024-06-06T18:52:54.353Z","modified":"2025-10-15T12:50:22.559Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:34:10.258163Z"}],"euvd":[{"id":"EUVD-2024-0090","description":"A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.","status":"published","published":"2024-06-06T18:52:54Z","modified":"2025-10-15T12:50:22Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:31:32.071816Z"}],"ghsa":[{"id":"GHSA-3hjh-jh2h-vrg6","title":"Denial of service in langchain-community","description":"Denial of service in `SitemapLoader` Document Loader in the `langchain-community` package, affecting versions below 0.2.5. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.","status":"published","published":"2024-06-06T21:30:36Z","modified":"2024-11-04T15:27:58Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T14:38:16.477822Z"}],"nvd":[{"id":"CVE-2024-2965","description":"A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.","status":"published","published":"2024-06-06T19:15:55.897Z","modified":"2026-06-17T07:25:55.317Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:10:04.111836Z"}],"osv":[{"id":"CVE-2024-2965","title":"Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchain","description":"A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.","status":"published","published":"2024-06-06T18:52:54.353Z","modified":"2026-10-28T02:30:28.755688584Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"GHSA-3hjh-jh2h-vrg6","title":"Denial of service in langchain-community","description":"Denial of service in `SitemapLoader` Document Loader in the `langchain-community` package, affecting versions below 0.2.5. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.","status":"published","published":"2024-06-06T21:30:36Z","modified":"2026-07-13T16:43:37.50631305Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"PYSEC-2024-118","description":"A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.","status":"published","published":"2024-06-06T19:15:00Z","modified":"2026-07-13T16:43:37.50631305Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"PYSEC-2026-2561","title":"Denial of service in langchain-community","description":"Denial of service in `SitemapLoader` Document Loader in the `langchain-community` package, affecting versions below 0.2.5. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.","status":"published","published":"2026-07-13T14:36:32.210054Z","modified":"2026-07-13T16:43:37.50631305Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}