CVE-2024-58339 is a resource exhaustion vulnerability (CWE-770) in the run-llama llama_index project, specifically in the VannaPack VannaQueryEngine's custom_query() function. This function constructs SQL queries from user input and executes them via vn.run_sql() without any throttling or limits on resource usage. In environments where untrusted users can supply prompts, this allows attackers to trigger expensive or unbounded SQL operations that exhaust CPU or memory resources, resulting in denial-of-service. The vulnerability affects versions up to and including 0.12.2.

An attacker able to supply prompts to the vulnerable llama_index component can cause excessive CPU or memory consumption by triggering unbounded or expensive SQL queries. This leads to denial-of-service conditions, potentially disrupting availability of the affected system or service. No evidence of privilege escalation or data confidentiality/integrity impact is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable custom_query() functionality to trusted users only or implement external query execution limits to prevent resource exhaustion.