« Volver al listado

CVE-2025-6208

Estado: AplazadaMedia (5.3)—

The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (`num_files_limit`) is applied after all files in a directory are loaded into memory. This can lead to memory exhaustion and degraded performance, particularly in environments with limited resources. The issue is resolved in version 0.12.41.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Llamaindex — Llama Index CoreAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-6208",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-6208",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-02T17:46:45.289617Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@huntr.dev",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@huntr.dev",
      "affectedData": [
        {
          "vendor": "run-llama",
          "product": "run-llama/llama_index",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "0.12.41",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-02T11:16:17.197",
  "references": [
    {
      "url": "https://github.com/run-llama/llama_index/commit/53614e2f7913c0e86b58add9470b3c900b6c60b2",
      "source": "security@huntr.dev"
    },
    {
      "url": "https://huntr.com/bounties/7d722bb6-6567-4608-8b23-f95048d7605a",
      "source": "security@huntr.dev"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@huntr.dev",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (`num_files_limit`) is applied after all files in a directory are loaded into memory. This can lead to memory exhaustion and degraded performance, particularly in environments with limited resources. The issue is resolved in version 0.12.41."
    },
    {
      "lang": "es",
      "value": "El componente 'SimpleDirectoryReader' en 'llama_index.core' versión 0.12.23 sufre de consumo de memoria descontrolado debido a un fallo en la gestión de recursos. La vulnerabilidad surge porque el límite de archivos especificado por el usuario ('num_files_limit') se aplica después de que todos los archivos de un directorio se cargan en la memoria. Esto puede provocar el agotamiento de la memoria y un rendimiento degradado, particularmente en entornos con recursos limitados. El problema se resuelve en la versión 0.12.41."
    }
  ],
  "lastModified": "2026-06-17T10:01:23.310",
  "sourceIdentifier": "security@huntr.dev"
}