CVE-2025-3225
An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service (DoS) by exhausting system memory and potentially causing a system crash. The issue is resolved in version v0.12.29.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.42%
- CWE
- CWE-776
- Published
- 2025-07-07
- Last modified
- 2026-03-12
Affected products
- run-llama run-llama/llama_index
Weakness type
Related vulnerabilities
- CVE-2026-58234 — Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)
- CVE-2026-16180 — IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- CVE-2026-78681 — NLTK before 3.10.3 Entity Expansion DoS via ElementTree
- CVE-2026-73569 — fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
- CVE-2026-3415 — XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
- CVE-2026-14865 — XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX
- CVE-2026-14979 — IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
- CVE-2026-45304 — Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")