CVE-2025-6208: llama-index-core Memory Exhaustion Vulnerability
Summary
CVE-2025-6208: llama-index-core vulnerable to Uncontrolled Resource Consumption. Affects llama-index-core versions < 0.12.41. Fixed in 0.12.41. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
llama-index-core is a Python package designed for efficient indexing and retrieval of data from directories. It allows users to manage and access large sets of files seamlessly. However, the package has a vulnerability that can lead to uncontrolled memory consumption, particularly when handling a large number of files, which can degrade performance and lead to application crashes.
Vulnerability Detail
The vulnerability in llama-index-core arises from the SimpleDirectoryReader component, which fails to enforce a user-specified file limit (num_files_limit) before loading all files in a directory into memory. This flaw can result in excessive memory usage, especially in environments with limited resources, potentially leading to memory exhaustion and degraded application performance. The issue is classified under CWE-400, indicating a resource management flaw.
How To Fix
Minimum fixed version
0.12.41
This is the first release that contains the fix.
pip install --upgrade "llama-index-core==0.12.41"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the number of files processed at once or implementing a custom file loading mechanism that checks the memory usage before loading additional files. However, the best solution is to update to the patched version.
Conclusion
The llama-index-core package has a significant vulnerability related to uncontrolled memory consumption, which can lead to performance issues and crashes. It is crucial for users to update to the latest version to mitigate these risks. Utilizing tools like Vulert can further enhance your security posture by providing real-time alerts for vulnerabilities.
See every vulnerability recorded for llama-index-core →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to memory exhaustion, causing the application to slow down or crash, particularly in resource-constrained environments.
Yes, the vulnerability is fixed in version 0.12.41 of the llama-index-core package. It is recommended to update to this version.
Vulert is a service that monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock. It helps you stay informed about potential security issues.
Related vulnerabilities
Recent vulnerabilities recorded for llama-index-core.
