Bug 2373306 (CVE-2024-2965)

Summary:	CVE-2024-2965 langchain-community: Langchain-community SitemapParser DoS Vulnerability
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anpicker, bbrownin, bparees, davidn, david.sastre, haoli, hasun, hkataria, jajackso, jcammara, jfula, jmitchel, jneedle, jowilson, jwong, kegrant, koliveir, kshier, mabashia, nyancey, ometelka, pbraun, ptisnovs, shvarugh, simaishi, smcdonal, stcannon, syedriko, teagle, tfister, thavo, ttakamiy, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in langchain-community. The `SitemapLoader` class's `parse_sitemap` method fails to limit the size of sitemaps it processes, allowing a malicious or oversized sitemap to exhaust server resources. A local attacker can trigger a denial of service condition by providing a specially crafted sitemap file. This lack of input validation can result in excessive memory consumption and service disruption.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-06-18 07:09:18 UTC

A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-community` package, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.