CVE-2024-58340

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-58340
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_parser.py). The parser applies a backtracking-prone regular expression when extracting tool actions from model output. An attacker who can supply or influence the parsed text (for example via prompt injection in downstream applications that pass LLM output directly into MRKLOutputParser.parse()) can trigger excessive CPU consumption by providing a crafted payload, causing significant parsing delays and a denial-of-service condition.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/langchain-ai/langchain Product
https://huntr.com/bounties/e7ece02c-d4bb-4166-8e08-6baf4f8845bb Exploit Issue Tracking Third Party Advisory
https://www.langchain.com/ Product
https://www.vulncheck.com/advisories/langchain-mrkloutputparser-redos Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*
History

17 Jun 2026, 08:14

Type Values Removed Values Added
Summary
  • (es) Las versiones de LangChain hasta la 0.3.1 inclusive contienen una vulnerabilidad de denegación de servicio por expresión regular (ReDoS) en el método MRKLOutputParser.parse() (libs/langchain/langchain/agents/mrkl/output_parser.py). El analizador aplica una expresión regular propensa a retrocesos al extraer acciones de herramientas de la salida del modelo. Un atacante que puede suministrar o influir en el texto analizado (por ejemplo, mediante inyección de prompt en aplicaciones posteriores que pasan la salida del LLM directamente a MRKLOutputParser.parse()) puede desencadenar un consumo excesivo de CPU al proporcionar una carga útil manipulada, causando retrasos significativos en el análisis y una condición de denegación de servicio.

21 Jan 2026, 17:57

Type Values Removed Values Added
References () https://github.com/langchain-ai/langchain - () https://github.com/langchain-ai/langchain - Product
References () https://huntr.com/bounties/e7ece02c-d4bb-4166-8e08-6baf4f8845bb - () https://huntr.com/bounties/e7ece02c-d4bb-4166-8e08-6baf4f8845bb - Exploit, Issue Tracking, Third Party Advisory
References () https://www.langchain.com/ - () https://www.langchain.com/ - Product
References () https://www.vulncheck.com/advisories/langchain-mrkloutputparser-redos - () https://www.vulncheck.com/advisories/langchain-mrkloutputparser-redos - Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Langchain langchain
Langchain
CPE cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*

12 Jan 2026, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-12 23:15

Updated : 2026-07-14 23:17

NVD link : CVE-2024-58340

Mitre link : CVE-2024-58340

CVE.ORG link : CVE-2024-58340

JSON object : View

Products Affected

langchain

  • langchain
CWE
CWE-1333

Inefficient Regular Expression Complexity