CVSS 3.0
5.3 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVE-2025-6208
Medium (5.3). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in llama-index-core 0.12.41.
The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (`num_files_limit`) is applied after all files in a directory are loaded into memory. This can lead to memory exhaustion and degraded performance, particularly in environments with limited resources. The issue is resolved in version 0.12.41.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-488g-hw5f-x29p | PyPI | llama-index-core | <0.12.41 | 0.12.41 |
| PYSEC-2026-1560 | PyPI | llama-index-core | <0.12.41 | 0.12.41 |