Listen to this Post
How the CVE Works
The CVE-2025-1752 vulnerability exploits a flaw in the `KnowledgeBaseWebReader` class of the `run-llama/llama_index` project (v0.12.15). The `get__urls` function fails to enforce the `max_depth` parameter correctly, allowing recursive calls without proper termination. An attacker can craft a malicious input that triggers excessive recursion, exhausting Python’s stack limit and causing a process crash. This leads to a Denial of Service (DoS) condition, disrupting service availability.
DailyCVE Form
Platform: llama_index
Version: 0.12.15
Vulnerability: Recursion DoS
Severity: Critical
Date: 07/30/2025
Prediction: Patch by 08/15/2025
What Undercode Say
Exploit PoC (simplified) def trigger_dos(target_url): reader = KnowledgeBaseWebReader() reader.get__urls(target_url, max_depth=10000) Exceeds recursion limit
How Exploit
- Craft deep recursive URL traversal
- Send malicious payload to `get__urls`
– Crash Python interpreter
Protection from this CVE
- Update to patched version
- Implement recursion depth validation
- Use iterative parsing
Impact
- Service disruption
- Resource exhaustion
- Unauthorized DoS
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
