AIKIDO-2026-163795
lightrag-hku is vulnerable to Regular Expression Denial of Service (ReDoS)
65
Medium Risk
This Affects:
lightrag-hkuTL;DR
The sentence_split_regex field of the chunking parameters accepted by POST /documents/text is a user-supplied regular expression whose validator in lightrag/api/routers/document_routes.py only checks that it compiles, not that it is safe. The pattern is then run with re.split against the user-supplied document body in lightrag/chunker/semantic_vector.py with no complexity limit or timeout. A request carrying a catastrophically backtracking pattern pins a CPU core indefinitely, holding the GIL so the server stops answering requests and does not recover without a restart. The fix removes the user-supplied sentence_split_regex option entirely.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the POST /documents/text or POST /documents/texts endpoints are reachable by clients who can supply chunking parameters.
Background info
lightrag-hku is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 0.0.1 - 1.5.4.
How to fix this
Upgrade the lightrag-hku library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant