Vulnerability · Published Feb 2, 2026 · Assigned by @huntr_ai

CVE-2025-6208Uncontrolled Memory Consumption in run-llama/llama_index

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in run-llama/llama_index from run-llama. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)5.3Medium

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (`num_files_limit`) is applied after all files in a directory are loaded into memory. This can lead to memory exhaustion and degraded performance, particularly in environments with limited resources. The issue is resolved in version 0.12.41.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	llama-index-core	0.12.41	GHSA-488g-hw5f-x29p
PyPI	llama-index-core	0.12.41	PYSEC-2026-1560

Affected products (as reported)

Vendor	Product	Versions
run-llama	run-llama/llama_index	unspecified – before 0.12.41

Weakness: CWE-400 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References