Description
The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (`num_files_limit`) is applied after all files in a directory are loaded into memory. This can lead to memory exhaustion and degraded performance, particularly in environments with limited resources. The issue is resolved in version 0.12.41.
References (2)
Core 2
Core References
Exploit, Third Party Advisory
https://huntr.com/bounties/7d722bb6-6567-4608-8b23-f95048d7605a
Scores
CVSS v3
5.3
EPSS
0.0037
EPSS Percentile
28.7%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-400
Status
published
Products (2)
pypi/llama-index-core
0 - 0.12.41PyPI
run-llama/run-llama/llama_index
unspecified - 0.12.41
Published
Feb 02, 2026
Tracked Since
Feb 18, 2026