Is CVE-2024-58340 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-58340 being exploited in the wild.

How severe is CVE-2024-58340?

High severity, with a CVSS score of 7.5, published 12 January 2026.

Which products and versions are affected?

langchain-exa (PyPI) ECOSYSTEM:introduced=0,fixed=1.0.0a1.

Is there a fix for CVE-2024-58340?

Yes. langchain-exa (PyPI): upgrade to 1.0.0a1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-58340 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-58340?

Check whether you run langchain-exa (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58340: LangChain ReDoS in MRKLOutputParser

CVE-2024-58340 · Severity: high · CVSS 7.5 · Published 2026-01-12

LangChain is a popular framework used to build applications powered by large language models (LLMs). A flaw in how the library processes text from AI models could allow an attacker to crash the application or cause significant performance delays. By using techniques like prompt injection to influence the AI's output, an attacker can force the system to consume excessive processor resources, leading to a denial-of-service condition.

Vendors: PyPI.

Quick answers

Is CVE-2024-58340 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-58340 being exploited in the wild.
How severe is CVE-2024-58340?: High severity, with a CVSS score of 7.5, published 12 January 2026.
Which products and versions are affected?: langchain-exa (PyPI) ECOSYSTEM:introduced=0,fixed=1.0.0a1.
Is there a fix for CVE-2024-58340?: Yes. langchain-exa (PyPI): upgrade to 1.0.0a1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58340 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-58340?: Check whether you run langchain-exa (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

langchain-exa (PyPI): upgrade to 1.0.0a1 or later
```
pip install "langchain-exa>=1.0.0a1"
```

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in LangChain's MRKLOutputParser.parse() method, located in libs/langchain/langchain/agents/mrkl/output_parser.py. The vulnerability is caused by a backtracking-prone regular expression used to extract tool actions from model outputs (CWE-1333). An attacker can exploit this by supplying or influencing the text passed to the parser, often through prompt injection in downstream applications. This results in catastrophic backtracking, leading to high CPU utilization and a denial-of-service (DoS) condition. The issue affects versions up to and including 0.3.1.

Affected products

LangChain AI LangChain <= 0.3.1

Identifiers

CVE-2024-58340
PYSEC-2026-75

Timeline

2026-01-12: advisory: Initial disclosure by VulnCheck
2026-01-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.