CVE-2025-5302

Advisory

Affected versions of the llama_index package are vulnerable to Denial of Service due to uncontrolled recursion in the JSONReader component. The JSONReader module processes deeply nested JSON structures without implementing proper recursion depth limits, causing Python to exceed its maximum recursion depth limit during parsing operations.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://huntr.com/bounties/70041b81-de9e-4046-8c0e-6ccd557048a6
• https://github.com/run-llama/llama_index/commit/c032843a02ce38fd8f284b2aa5a37fd1c17ae635
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5302