CVE-2024-12910: Llamaindex KnowledgeBaseWebReader DoS Flaw

CVE-2024-12910 Overview

CVE-2024-12910 affects the KnowledgeBaseWebReader class in the run-llama/llama_index repository. An attacker can trigger a Denial of Service (DoS) by supplying a URL variable equal to the root URL. This input causes infinite recursive calls to the get_article_urls method. The recursion exhausts system resources and can crash the application.

The issue is classified as [CWE-674: Uncontrolled Recursion]. It affects the llama-index-readers-web integration package used to crawl knowledge base or help center content with Playwright. The vulnerability requires no authentication and is exploitable over the network.

Critical Impact
Remote attackers can crash LlamaIndex-based applications that ingest attacker-controlled URLs into KnowledgeBaseWebReader, resulting in service unavailability.

Affected Products

run-llama/llama_index (llama-index-readers-web) prior to version 0.3.3
KnowledgeBaseWebReader class in llama_index/readers/web/knowledge_base/base.py
Downstream applications embedding the vulnerable reader for web crawling

Discovery Timeline

2025-03-20 - CVE-2024-12910 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12910

Vulnerability Analysis

The KnowledgeBaseWebReader class crawls knowledge base articles by recursively discovering URLs through get_article_urls. When the URL variable passed to the reader equals the root URL of the crawl target, the recursion terminating condition never triggers. Each invocation of get_article_urls re-enters itself with the same root, generating unbounded self-calls.

Unbounded recursion consumes stack frames and heap memory allocated for Playwright browser contexts, HTTP responses, and URL bookkeeping structures. The Python interpreter eventually raises RecursionError, but before that occurs the browser processes and network I/O saturate the host. Applications using this reader in server-side workflows become unresponsive.

The attack requires no privileges and no user interaction. Exploitation only requires that an attacker influence the URL passed to the reader, which is common in Retrieval-Augmented Generation (RAG) pipelines that accept user-supplied sources.

Root Cause

The root cause is missing recursion depth control and missing input normalization in get_article_urls. The function does not deduplicate visited URLs against the seed root, and it does not enforce a maximum crawl depth. This matches the [CWE-674] pattern of uncontrolled recursion driven by attacker-controlled input.

Attack Vector

An attacker submits a crafted URL to any application endpoint that instantiates KnowledgeBaseWebReader with user input. The reader begins crawling, calls get_article_urls on the root, and re-enters the same function with the identical root URL. The recursion continues until resources are exhausted.

python

# Security patch context - llama-index-readers-web/pyproject.toml
# Vulnerable version bumped to fixed release
-version = "0.3.2"
+version = "0.3.3"

# Patch applied in llama_index/readers/web/knowledge_base/base.py
# Source: https://github.com/run-llama/llama_index/commit/159ce485a1168100bb219dc1b93133f1121579d9
class KnowledgeBaseWebReader(BaseReader):
    """
    Knowledge base reader.

    Crawls and reads articles from a knowledge base/help center with Playwright.
    Tested on Zendesk and Intercom CMS, may work on others.
    """

Source: GitHub Commit 159ce485

Detection Methods for CVE-2024-12910

Indicators of Compromise

Repeated Python RecursionError exceptions or process crashes in application logs referencing get_article_urls or KnowledgeBaseWebReader.
Sudden spikes in Playwright browser process counts or memory usage on hosts running llama-index-readers-web.
Inbound requests supplying URL parameters that match the configured knowledge base root URL.

Detection Strategies

Instrument the LlamaIndex reader to log the crawl depth and URL queue size, then alert on abnormal growth.
Inspect API request payloads for URL fields that resolve to the same host as the configured crawl root.
Correlate application crash events with preceding high-cardinality URL submissions from a single source.

Monitoring Recommendations

Track CPU, RSS memory, and process counts for containers running LlamaIndex ingestion workers.
Monitor error rates and 5xx responses from services exposing KnowledgeBaseWebReader functionality.
Alert on log entries containing maximum recursion depth exceeded originating from llama_index.readers.web.

How to Mitigate CVE-2024-12910

Immediate Actions Required

Upgrade llama-index-readers-web to version 0.3.3 or later, which contains the fix from commit 159ce485.
Audit application code paths that pass user-controlled URLs into KnowledgeBaseWebReader and add input validation.
Rate-limit and authenticate endpoints that accept URLs for knowledge base ingestion.

Patch Information

The fix is delivered in llama-index-readers-web version 0.3.3. See the GitHub Commit Details for the patch and the Huntr Bug Bounty Report for the underlying disclosure.

Workarounds

Reject URLs that resolve to the same location as the configured root before invoking the reader.
Wrap crawler invocations with a timeout and a hard recursion or depth limit at the application layer.
Isolate ingestion workers in resource-constrained containers to contain resource exhaustion.

bash

# Upgrade to the patched release
pip install --upgrade "llama-index-readers-web>=0.3.3"

# Verify installed version
pip show llama-index-readers-web | grep -i version