CVE-2024-9277: Langflow HTTP POST Request Handler Suffers from Inefficient Regular Expression Complexity
Summary
CVE-2024-9277: Inefficient Regular Expression Complexity in langflow. Affects langflow versions < 1.0.18. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langflow is an open-source framework designed for building and deploying language models. It provides a user-friendly interface for interacting with various language processing tasks. However, like many software packages, it is susceptible to vulnerabilities that can affect its performance and security. The specific vulnerability in question relates to the HTTP POST Request Handler, which processes incoming requests and manipulates text data.
Vulnerability Detail
A vulnerability classified as problematic was discovered in Langflow versions up to 1.0.18. The issue arises from an inefficient regular expression complexity in the HTTP POST Request Handler, specifically in the manipulation of the 'remaining_text' argument within the utils.py file. This inefficiency can lead to performance degradation and potential denial of service, as attackers may exploit this vulnerability to craft requests that cause excessive resource consumption. The vulnerability has been publicly disclosed, and while the vendor was informed, there has been no response regarding a fix.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may limit the size of incoming requests to the HTTP POST Request Handler to mitigate the impact of this vulnerability. This can be done by implementing a size check in your request handling logic. For example:
if len(request.data) > MAX_REQUEST_SIZE:
return 'Request too large', 413
Conclusion
The CVE-2024-9277 vulnerability in Langflow highlights the importance of regular updates and monitoring for open-source software. By following the recommended steps to update the package and implementing temporary workarounds, users can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for langflow →
FAQ
CVE-2024-9277 is a vulnerability in Langflow that involves inefficient regular expression complexity in the HTTP POST Request Handler, potentially leading to performance issues.
Langflow versions up to 1.0.18 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 3.5, indicating a moderate level of risk.
Yes, updating to the latest version of Langflow will address this vulnerability. Use 'pip install --upgrade langflow' to update.
Related vulnerabilities
Recent vulnerabilities recorded for langflow.
