CVE-2025-6208: llama-index-core vulnerable to Uncontrolled Resource Consumption

February 2, 2026

The SimpleDirectoryReader component in llama_index.core version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (num_files_limit) is applied after all files in a directory are loaded into memory. This can lead to memory exhaustion and degraded performance, particularly in environments with limited resources. The issue is resolved in version 0.12.41.

References

github.com/advisories/GHSA-488g-hw5f-x29p
github.com/run-llama/llama_index
github.com/run-llama/llama_index/commit/53614e2f7913c0e86b58add9470b3c900b6c60b2
huntr.com/bounties/7d722bb6-6567-4608-8b23-f95048d7605a
nvd.nist.gov/vuln/detail/CVE-2025-6208

Code Behaviors & Features

Detect and mitigate CVE-2025-6208 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →