Filtered by vendor Langchain Subscriptions
Filtered by product Langchain Core Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-58340 2 Langchain, Langchain-ai 3 Langchain, Langchain Core, Langchain 2026-03-05 7.5 High
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_parser.py). The parser applies a backtracking-prone regular expression when extracting tool actions from model output. An attacker who can supply or influence the parsed text (for example via prompt injection in downstream applications that pass LLM output directly into MRKLOutputParser.parse()) can trigger excessive CPU consumption by providing a crafted payload, causing significant parsing delays and a denial-of-service condition.
CVE-2025-68664 2 Langchain, Langchain-ai 2 Langchain Core, Langchain 2026-01-13 9.3 Critical
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.