Vulnerability · Published Jan 12, 2026 · Assigned by VulnCheck
CVE-2024-58340LangChain <= 0.3.1 MRKLOutputParser ReDoS
High 8.7
In plain English
A high-severity regular-expression denial of service in LangChain from LangChain AI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_parser.py). The parser applies a backtracking-prone regular expression when extracting tool actions from model output. An attacker who can supply or influence the parsed text (for example via prompt injection in downstream applications that pass LLM output directly into MRKLOutputParser.parse()) can trigger excessive CPU consumption by providing a crafted payload, causing significant parsing delays and a denial-of-service condition.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | langchain-exa | 1.0.0a1 | PYSEC-2026-75 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LangChain AI | LangChain | 0 – through 0.3.1 |
Weakness: CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://huntr.com/bounties/e7ece02c-d4bb-4166-8e08-6baf4f8845bb technical-description, exploit
- https://www.langchain.com/ product
- https://github.com/langchain-ai/langchain product
- https://www.vulncheck.com/advisories/langchain-mrkloutputparser-redos third-party-advisory