CVE-2025-5472 Overview
CVE-2025-5472 is a denial-of-service vulnerability in the JSONReader component of run-llama/llama_index version 0.12.28. The flaw stems from uncontrolled recursion during JSON parsing [CWE-674]. Attackers can submit deeply nested JSON structures that trigger a RecursionError, exhausting the Python call stack and crashing the host application. The vulnerability affects the availability of any service that ingests untrusted JSON through the JSONReader interface. The maintainers resolved the issue in version 0.12.38 by introducing depth validation in the recursive traversal logic.
Critical Impact
Remote attackers can crash llama_index-based applications by submitting maliciously crafted, deeply nested JSON documents, disrupting AI workflows that depend on the JSONReader.
Affected Products
- run-llama/llama_index version 0.12.28
- All llama_index deployments using JSONReader prior to 0.12.38
- Downstream applications and services embedding vulnerable llama_index releases
Discovery Timeline
- 2025-07-07 - CVE-2025-5472 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5472
Vulnerability Analysis
The JSONReader class in llama_index parses JSON documents by recursively traversing every nested object and array. The implementation does not enforce a maximum recursion depth. When the parser encounters deeply nested structures, each level consumes a Python stack frame until the interpreter raises a RecursionError. Because the exception is unhandled in typical integration paths, the parent process crashes. Attackers require no authentication, only the ability to submit JSON input that the application processes with JSONReader. The vulnerability affects availability but does not expose data or permit code execution.
Root Cause
The root cause is an unsafe recursive traversal design combined with the absence of depth validation. The parser trusts the structure of the input and continues to descend into nested elements without bounding the call chain. Python enforces a default recursion limit near 1,000 frames, so an attacker only needs a moderately nested payload to trigger the crash. This pattern maps to CWE-674, Uncontrolled Recursion.
Attack Vector
An attacker delivers a crafted JSON document to any endpoint or ingestion pipeline that forwards input to JSONReader. Retrieval-Augmented Generation (RAG) pipelines, document ingestion services, and agentic tools that load user-supplied JSON are the primary exposure points. Successful exploitation terminates the worker process and disrupts dependent AI workflows. Repeated requests amplify the impact by continuously crashing restarted workers.
No verified proof-of-concept code is published. Technical detail is available in the Huntr Bounty Report and the upstream fix commit (GitHub Commit c032843).
Detection Methods for CVE-2025-5472
Indicators of Compromise
- Application logs containing RecursionError: maximum recursion depth exceeded originating from llama_index modules
- Unexpected worker process terminations correlated with JSON ingestion events
- Inbound requests carrying JSON payloads with abnormally deep nesting or oversized brace/bracket counts
Detection Strategies
- Inspect JSON payloads at the application gateway and flag documents exceeding a safe nesting depth (for example, greater than 100 levels)
- Instrument the JSONReader call path with structured logging to capture parser exceptions and payload metadata
- Correlate service restart events with recent JSON ingestion activity to identify DoS attempts
Monitoring Recommendations
- Track process crash rates and stack trace patterns for services embedding llama_index
- Alert on repeated RecursionError exceptions within short time windows from the same source
- Monitor request rates and payload sizes on document ingestion endpoints for anomalies
How to Mitigate CVE-2025-5472
Immediate Actions Required
- Upgrade llama_index to version 0.12.38 or later across all production, staging, and development environments
- Inventory services that use JSONReader and prioritize patching those exposed to untrusted input
- Restrict access to JSON ingestion endpoints using authentication and network-level controls where feasible
Patch Information
The fix is included in llama_index version 0.12.38. The upstream patch is available in the run-llama/llama_index commit c032843. Review the Huntr Bounty Report for the full technical write-up.
Workarounds
- Validate incoming JSON documents and reject payloads that exceed a defined maximum nesting depth before they reach JSONReader
- Wrap JSONReader calls in exception handlers that catch RecursionError and return a controlled error response
- Enforce request size limits at the reverse proxy or API gateway to reduce the attack surface
# Configuration example
pip install --upgrade "llama-index>=0.12.38"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
