CVE-2025-6208: llama_index.core DoS Vulnerability

CVE-2025-6208 Overview

A resource exhaustion vulnerability has been identified in the SimpleDirectoryReader component of llama_index.core version 0.12.23. The vulnerability arises from a resource management flaw where the user-specified file limit (num_files_limit) is applied only after all files in a directory have been loaded into memory. This improper sequencing allows for uncontrolled memory consumption, potentially leading to memory exhaustion and degraded system performance, particularly in resource-constrained environments.

Critical Impact

Applications using the vulnerable SimpleDirectoryReader component to process directories with large numbers of files may experience memory exhaustion and denial of service conditions, as the file limit parameter fails to prevent initial memory consumption.

Affected Products

• llama_index.core version 0.12.23
• LlamaIndex versions prior to 0.12.41

Discovery Timeline

• 2026-02-02 - CVE CVE-2025-6208 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-6208

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The core issue lies in the implementation logic of the SimpleDirectoryReader component, which is designed to read files from a specified directory for document processing in LlamaIndex applications.

The num_files_limit parameter was intended to allow developers to control how many files are processed from a directory. However, the implementation flaw causes all files to be loaded into memory first, with the limit only being applied afterward during filtering. This design deficiency means that even when a developer explicitly sets a low file limit, the component will still consume memory proportional to the total number of files in the directory.

In environments where LlamaIndex is deployed to process directories containing thousands of files, this vulnerability can be exploited to cause denial of service conditions through memory exhaustion.

Root Cause

The root cause is an improper order of operations in the SimpleDirectoryReader component. Instead of checking the num_files_limit parameter before loading files into memory, the implementation loads all directory contents first and then applies the limit filter. This represents a classic resource management flaw where defensive limits are checked too late in the processing pipeline to be effective.

Attack Vector

The attack vector is network-based, requiring no user interaction or special privileges. An attacker could exploit this vulnerability by:

1. Providing a path to a directory containing an extremely large number of files
2. Triggering the SimpleDirectoryReader to process this directory
3. Causing the application to exhaust available memory before the num_files_limit parameter takes effect

The vulnerability can be exploited in any deployment where user input influences the directory path processed by SimpleDirectoryReader, or where the component is used against directories with unexpectedly large file counts.

The fix implemented in version 0.12.41 modifies the file loading logic to apply the num_files_limit constraint before loading files into memory, preventing the resource exhaustion condition. For technical details on the specific code changes, refer to the GitHub commit.

Detection Methods for CVE-2025-6208

Indicators of Compromise

• Abnormal memory consumption spikes in applications using LlamaIndex SimpleDirectoryReader
• Application crashes or out-of-memory errors during directory processing operations
• Slow system performance or unresponsiveness when loading documents from directories
• Log entries indicating memory allocation failures in LlamaIndex components

Detection Strategies

• Monitor memory utilization patterns for applications using LlamaIndex document processing
• Implement application-level logging to track directory operations and file counts processed by SimpleDirectoryReader
• Set up alerts for sudden memory consumption increases in LlamaIndex-based services
• Review application dependencies to identify installations of llama_index.core version 0.12.23 or earlier

Monitoring Recommendations

• Deploy memory usage monitoring with threshold-based alerting for LlamaIndex application processes
• Implement resource limits (cgroups, container limits) to contain memory exhaustion impacts
• Monitor system-level metrics including available memory and swap usage on hosts running affected applications
• Set up dependency scanning to identify vulnerable LlamaIndex versions across your environment

How to Mitigate CVE-2025-6208

Immediate Actions Required

• Upgrade llama_index.core to version 0.12.41 or later where this vulnerability is resolved
• Audit all applications using SimpleDirectoryReader to identify potential exposure
• Implement input validation to restrict directory paths to trusted locations with known file counts
• Deploy resource limits at the container or process level to prevent memory exhaustion from affecting other services

Patch Information

The vulnerability is fixed in LlamaIndex version 0.12.41. The patch modifies the SimpleDirectoryReader component to apply the num_files_limit parameter before loading files into memory, ensuring that resource constraints are enforced early in the processing pipeline.

The fix can be reviewed in the GitHub commit. Additional details about the vulnerability discovery are available in the Huntr bug bounty report.

Workarounds

• Pre-filter directories to contain only the required number of files before passing to SimpleDirectoryReader
• Implement application-level memory limits to prevent complete system exhaustion
• Use alternative document loading approaches that process files iteratively rather than loading all into memory
• Deploy the application in containerized environments with strict memory constraints to limit blast radius

# Upgrade LlamaIndex to patched version
pip install --upgrade llama-index-core>=0.12.41

# Verify installed version
pip show llama-index-core | grep Version