id: PYSEC-2026-2561
published: "2026-07-13T14:36:32.210054Z"
modified: "2026-07-13T16:04:29.534545Z"
aliases:
- CVE-2024-2965
- GHSA-3hjh-jh2h-vrg6
summary: Denial of service in langchain-community
details: Denial of service in `SitemapLoader` Document Loader in the `langchain-community` package, affecting versions below 0.2.5. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.
affected:
- package:
    name: langchain-community
    ecosystem: PyPI
    purl: pkg:pypi/langchain-community
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.2.5
  versions:
  - 0.0.1
  - 0.0.10
  - 0.0.11
  - 0.0.12
  - 0.0.13
  - 0.0.14
  - 0.0.15
  - 0.0.16
  - 0.0.17
  - 0.0.18
  - 0.0.19
  - 0.0.1rc1
  - 0.0.1rc2
  - 0.0.2
  - 0.0.20
  - 0.0.21
  - 0.0.22
  - 0.0.23
  - 0.0.24
  - 0.0.25
  - 0.0.26
  - 0.0.27
  - 0.0.28
  - 0.0.29
  - 0.0.3
  - 0.0.30
  - 0.0.31
  - 0.0.32
  - 0.0.33
  - 0.0.34
  - 0.0.35
  - 0.0.36
  - 0.0.37
  - 0.0.38
  - 0.0.4
  - 0.0.5
  - 0.0.6
  - 0.0.7
  - 0.0.8
  - 0.0.9
  - 0.2.0
  - 0.2.0rc1
  - 0.2.1
  - 0.2.2
  - 0.2.3
  - 0.2.4
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2024-2965
- type: WEB
  url: https://github.com/langchain-ai/langchain/pull/22903
- type: WEB
  url: https://github.com/langchain-ai/langchain/commit/73c42306745b0831aa6fe7fe4eeb70d2c2d87a82
- type: WEB
  url: https://github.com/langchain-ai/langchain/commit/9a877c7adbd06f90a2518152f65b562bd90487cc
- type: PACKAGE
  url: https://github.com/langchain-ai/langchain
- type: WEB
  url: https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-118.yaml
- type: WEB
  url: https://huntr.com/bounties/90b0776d-9fa6-4841-aac4-09fde5918cae
- type: PACKAGE
  url: https://pypi.org/project/langchain-community
- type: ADVISORY
  url: https://github.com/advisories/GHSA-3hjh-jh2h-vrg6
severity:
- type: CVSS_V3
  score: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H