CVE-2024-1455
Published: 26 March 2024
Summary
CVE-2024-1455 is a medium-severity XML Entity Expansion (CWE-776) vulnerability in Langchain Langchain. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 28.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Other ATLAS/OWASP Terms risk domain; MITRE ATLAS techniques in scope: External Harms (AML.T0048).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0987
Vulnerability details
A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive…
more
CPU and memory resources, leading to a denial of service (DoS).
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- LangChain (langchain-ai/langchain) is a framework for building applications with LLMs, including AI agents, chains, and integrations with language models, tools, and external services.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE enables a Billion Laughs XML attack (XXE variant) that exploits the LangChain library's XML parser to cause excessive CPU/memory consumption, facilitating endpoint DoS via application exploitation.
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.