LiveActive security incident?Get immediate response
CVE Record

CVE-2024-58339: LlamaIndex <= 0.12.2 VannaQueryEngine SQL Execution Allows Resource Exhaustion

LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() logic generates SQL statements from a user-supplied prompt and executes them via vn.run_sql() without enforcing query execution limits In downstream deployments where untrusted users can supply prompts, an attacker can trigger expensive or unbounded SQL operations that exhaust CPU or memory resources, resulting in a denial-of-service condition. The vulnerable execution path occurs in llama_index/packs/vanna/base.py within custom_query().

HighCVSS 8.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Applications using LlamaIndex VannaQueryEngine through version 0.12.2 may let an unauthenticated user submit prompts that produce costly database queries. Without execution limits, those queries can consume excessive CPU or memory and disrupt service. The reported impact is denial of service, not confirmed data theft or modification.

Executive priority

Prioritize assessment for internet-facing or multi-tenant AI-to-database services because disruption can be triggered without authentication under the stated conditions. Immediately constrain public prompt access and database resource usage where exposure exists. Schedule remediation promptly, but verify the vendor-supported fixed version because the supplied sources do not name one.

Technical view

CVE-2024-58339 is a CWE-770 uncontrolled resource consumption flaw in VannaPack. In llama_index/packs/vanna/base.py, custom_query() generates SQL from a user prompt and passes it to vn.run_sql() without query-execution limits. The supplied CVSS 4.0 score is 8.7, reflecting remotely reachable, low-complexity availability impact without required privileges or user interaction.

Likely exposure

Exposure is most likely where LlamaIndex 0.12.2 or earlier uses VannaPack VannaQueryEngine and untrusted users can submit prompts reaching custom_query(). Deployments without this component, without untrusted prompt access, or with effective downstream database resource controls may have reduced or no exposure. The supplied affected-version metadata is otherwise incomplete.

Exploitation context

The source bundle identifies a remotely triggerable denial-of-service condition and links a technical bounty report. It does not establish exploitation in the wild, and the CVE is not listed as KEV in the supplied data. No evidence provided supports claims of data disclosure, data modification, or system takeover.

Researcher notes

The reported sink is vn.run_sql() inside VannaQueryEngine custom_query(), following SQL generation from user-controlled prompts. Validation should remain controlled and focus on reachability and defensive resource limits, avoiding production load. Evidence supports availability loss through resource exhaustion; it does not substantiate confidentiality or integrity impact. No official patch version is identified in the bundle.

Mitigation direction

  • Identify deployments using VannaPack VannaQueryEngine in LlamaIndex 0.12.2 or earlier.
  • Restrict untrusted access to prompt interfaces that can reach custom_query().
  • Apply database query time, CPU, memory, and concurrency limits where supported.
  • Check current LlamaIndex vendor guidance for a fixed release or official remediation.
  • Monitor database saturation and repeated resource-intensive requests affecting this execution path.

Validation and detection

  • Inventory installed LlamaIndex versions and confirm whether VannaPack is enabled.
  • Trace whether unauthenticated or untrusted prompts can reach VannaQueryEngine custom_query().
  • Review database controls for query duration, resource consumption, and concurrent execution.
  • Inspect monitoring data for unexplained database saturation associated with prompt requests.
  • Verify vendor guidance before declaring an upgraded version remediated.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-770: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-58339 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.7 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.7CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

8.7High
CVSS 4.0 vector shape for CVE-2024-58339Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
run-llamallama_index0unknown
Weakness

CWE details

CWE-770

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-770 · source CWE mapping

Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs