AIKIDO-2026-163795

lightrag-hku is vulnerable to Regular Expression Denial of Service (ReDoS)

GHSA-32jh-39m7-8x84Published Aug 3, 2026

CVE Score

Medium

Regular Expression Denial of Service (ReDoS)

TL;DR

The sentence_split_regex field of the chunking parameters accepted by POST /documents/text is a user-supplied regular expression whose validator in lightrag/api/routers/document_routes.py only checks that it compiles, not that it is safe. The pattern is then run with re.split against the user-supplied document body in lightrag/chunker/semantic_vector.py with no complexity limit or timeout. A request carrying a catastrophically backtracking pattern pins a CPU core indefinitely, holding the GIL so the server stops answering requests and does not recover without a restart. The fix removes the user-supplied sentence_split_regex option entirely.

How do I fix this?

Upgrade the lightrag-hku library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and the POST /documents/text or POST /documents/texts endpoints are reachable by clients who can supply chunking parameters.