CVE-2024-58340: ReDoS in LangChain MRKL agent output parser
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) flaw in MRKLOutputParser.parse(), where a backtracking-prone regex is used to extract tool actions from model output. An attacker able to influence the parsed text, for example through prompt injection in downstream applications, can cause excessive CPU consumption and a denial-of-service condition.
Disclosed 12 January 2026 · Record updated 13 September 2026
Impact
Crafted or injected model output can trigger excessive CPU consumption in the MRKL agent output parser, causing significant parsing delays and denial of service in applications built on LangChain.
Our coverage
No articles linked to this incident yet.
Sources
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2024-58340