AIKIDO-2026-93270
lightrag-hku is vulnerable to Uncontrolled Resource Consumption
75
High Risk
This Affects:
lightrag-hkuTL;DR
The LightRAG API server accepts a request-supplied separators list for the recursive-character chunker on its document-ingestion routes with no length bound. Because the chunker runs synchronously on the asyncio event loop and re-tokenizes the whole document once per separator, a single request with many separators drives work proportional to separators times text length and blocks every other request. An unbounded request body compounds this, so one ingestion request can freeze the entire server for an extended period. The fix bounds the separator cascade and moves chunking off the event loop.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the LightRAG API server and accept untrusted document-ingestion requests.
Background info
lightrag-hku is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 1.5.5.
How to fix this
Upgrade the lightrag-hku library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant