CVE-2025-6208

Description

The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (`num_files_limit`) is applied after all files in a directory are loaded into memory. This can lead to memory exhaustion and degraded performance, particularly in environments with limited resources. The issue is resolved in version 0.12.41.

PUBLISHED Reserved 2025-06-17 | Published 2026-02-02 | Updated 2026-02-02 | Assigner @huntr_ai

Problem types

CWE-400 Uncontrolled Resource Consumption

Product status

References

huntr.com/bounties/7d722bb6-6567-4608-8b23-f95048d7605a

github.com/...ommit/53614e2f7913c0e86b58add9470b3c900b6c60b2

cve.org (CVE-2025-6208)

nvd.nist.gov (CVE-2025-6208)

Download JSON