{"cve":"CVE-2025-5302","nvd":{"published":"2025-08-25T15:15:42.243","modified":"2026-06-17T09:47:38.620","status":"Deferred","description":"A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth limit. This results in high resource consumption and potential crashes of the Python process. The issue is resolved in version 0.12.38.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":8.6},"cwes":["CWE-674"],"references":["https://github.com/run-llama/llama_index/commit/c032843a02ce38fd8f284b2aa5a37fd1c17ae635","https://huntr.com/bounties/70041b81-de9e-4046-8c0e-6ccd557048a6"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:07:46.309729541+00:00"},"epss":{"cve":"CVE-2025-5302","score":0.00285,"percentile":0.21073,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-7753-xrfw-ch36","url":"https://osv.dev/vulnerability/GHSA-7753-xrfw-ch36","summary":"LlamaIndex affected by a Denial of Service (DOS) in JSONReader","modified":"2026-07-07T17:56:52.377276279Z","packages":[{"ecosystem":"PyPI","name":"llama-index-core","purl":"pkg:pypi/llama-index-core","ranges":["<0.12.38"],"fixed":["0.12.38"]}]},{"id":"PYSEC-2026-1561","url":"https://osv.dev/vulnerability/PYSEC-2026-1561","summary":"LlamaIndex affected by a Denial of Service (DOS) in JSONReader","modified":"2026-07-07T17:46:14.051600270Z","packages":[{"ecosystem":"PyPI","name":"llama-index-core","purl":"pkg:pypi/llama-index-core","ranges":["<0.12.38"],"fixed":["0.12.38"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}