Is CVE-2024-58339 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-58339 being exploited in the wild.

How severe is CVE-2024-58339?

High severity, with a CVSS score of 7.5, published 12 January 2026.

Which products and versions are affected?

Llamaindex <= 0.12.2; llama-index (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.3.

Is there a fix for CVE-2024-58339?

Yes. llama-index (PyPI): upgrade to 0.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-58339 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-58339?

Check whether you run Llamaindex or llama-index (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58339: LlamaIndex resource exhaustion in VannaQueryEngine SQL execution

Q: Which products and versions are affected?

Llamaindex <= 0.12.2; llama-index (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.3.

Q: Is there a fix for CVE-2024-58339?

Yes. llama-index (PyPI): upgrade to 0.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-58339 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2024-58339?

Check whether you run Llamaindex or llama-index (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58339 · Severity: high · CVSS 7.5 · Published 2026-01-12

LlamaIndex, a popular framework for building AI applications, contains a vulnerability in its VannaQueryEngine component. This component is responsible for translating natural language prompts into SQL database queries. An attacker can provide a specially crafted prompt that generates extremely complex or resource-intensive database queries, potentially crashing the application or the underlying database and causing a service outage.

Technologies: Llamaindex, llama-index (PyPI). Vendors: Llamaindex, PyPI.

Quick answers

Is CVE-2024-58339 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-58339 being exploited in the wild.
How severe is CVE-2024-58339?: High severity, with a CVSS score of 7.5, published 12 January 2026.
Which products and versions are affected?: Llamaindex <= 0.12.2; llama-index (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.3.
Is there a fix for CVE-2024-58339?: Yes. llama-index (PyPI): upgrade to 0.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58339 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-58339?: Check whether you run Llamaindex or llama-index (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

llama-index (PyPI): upgrade to 0.12.3 or later
```
pip install "llama-index>=0.12.3"
```

Technical details

An uncontrolled resource consumption vulnerability exists in LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 within the VannaPack VannaQueryEngine implementation. The root cause is located in the custom_query() logic in llama_index/packs/vanna/base.py, which generates SQL statements from user-supplied prompts and executes them via vn.run_sql() without enforcing execution limits or timeouts. A remote, unauthenticated attacker can exploit this by providing prompts that result in unbounded or computationally expensive SQL queries. This can lead to CPU and memory exhaustion on the database or application server, resulting in a denial-of-service (DoS) condition. Users are advised to upgrade to a version beyond 0.12.2 or implement strict query limits and input validation.

Affected products

run-llama LlamaIndex <= 0.12.2

Identifiers

CVE-2024-58339
PYSEC-2026-86

Timeline

2026-01-12: advisory: Initial disclosure by VulnCheck
2026-01-12: disclosed: CVE-2024-58339 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.