CVE-2024-58340 is a high severity vulnerability (CVSS 8.7) affecting LangChain AI's LangChain product up to version 0.3.1. The issue is a ReDoS vulnerability in the MRKLOutputParser.parse() method, where a backtracking-prone regular expression is applied to extract tool actions from model output. If an attacker can supply or influence the input text parsed by this method, such as through prompt injection in downstream applications that pass LLM output directly into this parser, they can trigger excessive CPU usage. This results in significant delays during parsing and can cause denial-of-service conditions.

Exploitation of this vulnerability allows an unauthenticated attacker who can influence the input to the MRKLOutputParser.parse() method to cause excessive CPU consumption. This leads to significant parsing delays and denial-of-service conditions, potentially disrupting the availability of applications relying on LangChain's parsing functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted or attacker-controlled input directly into the MRKLOutputParser.parse() method to reduce the risk of triggering the ReDoS condition.