CVE-2025-3044
published 2025-07-07CVE-2025-3044: A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating…
PriorityP428medium5.3CVSS 3.0
AVNACLPRNUINSUCNILAN
EPSS
0.28%
19.8th percentile
A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training. The issue is resolved in version 0.12.28.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| llamaindex | llamaindex | < 0.12.28 | 0.12.28 |
| run-llama | run-llama_llama_index | >= unspecified < 0.12.28 | 0.12.28 |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions
ghsa·2025-07-07
CVE-2025-3044 [MEDIUM] CWE-440 LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions
LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions
A vulnerability in the ArxivReader class of the run-llama/llama_index repository allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training. The issue is resolved in llama-index-readers-papers version 0.3.1 (in llama-index 0.12.28).
OSV
LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions
osv·2025-07-07
CVE-2025-3044 [MEDIUM] LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions
LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions
A vulnerability in the ArxivReader class of the run-llama/llama_index repository allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training. The issue is resolved in llama-index-readers-papers version 0.3.1 (in llama-index 0.12.28).
Red Hat
llama-index: MD5 Hash Collision in llama_index
vendor_redhat·2025-07-07·CVSS 5.3
CVE-2025-3044 [MEDIUM] CWE-440 llama-index: MD5 Hash Collision in llama_index
llama-index: MD5 Hash Collision in llama_index
A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training. The issue is resolved in version 0.12.28.
A hash collision flaw was found in llama_index. The MD5 function is used in the ArxivReader class, and given the weakness in the MD5 hashing algorithm, an attacker can build colliding inputs.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria c
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-07
Published