Cyber Resilience

CVE-2025-1752

HighPublic PoCDDoS

Published: 10 May 2025

Published
10 May 2025
Modified
15 October 2025
KEV Added
Patch
CVSS Score v3 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0016 36.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1752 is a high-severity Uncontrolled Recursion (CWE-674) vulnerability in Llamaindex Llamaindex. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 36.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_depth parameter…

more

in the get_article_urls function. This allows an attacker to exhaust Python's recursion limit through repeated function calls, leading to resource consumption and ultimately crashing the Python process.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

The vulnerability enables denial of service by exploiting lack of recursion depth limits in the get_article_urls function, exhausting Python's recursion limit and crashing the process (T1499.004: Application or System Exploitation).

Affected Assets

llamaindex
llamaindex
≤ 0.3.6

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-674

Supports resumption at alternate site when uncontrolled recursion causes primary site failure or crash.

addresses: CWE-674

Prevents uncontrolled recursion that exhausts stack or CPU resources.

References