The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a Denial-of-Service (DoS) vulnerability in the `SitemapLoader` class. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

LangChain < 0.2.5 DoS

medium Nessus Plugin ID 213567

Version 1.1