CVE-2025-6211 - CVE House
Back to Database
Status published Medium CVE-2025-6211

MD5 Hash Collision in run-llama/llama_index

Vulnerability Description

A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk overwriting another. This can cause loss of semantically or legally important document content, breakage of parent-child chunk hierarchies, and inaccurate or hallucinated responses in AI outputs. The issue is resolved in version 0.3.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6211

Credits & Attribution

No credits recorded in the NVD database.

References

More from run-llama

View All →
CVE-2025-7707
World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index
High 7.1
CVE-2025-7647
Insecure Temporary File Handling in run-llama/llama_index
High 7.3
CVE-2025-6210
Hardlink-Based Path Traversal in run-llama/llama_index
Medium 6.2
CVE-2025-6209
Arbitrary File Read through Path Traversal in run-llama/llama_index
High 7.5
CVE-2025-6208
Uncontrolled Memory Consumption in run-llama/llama_index
Medium 5.3

Affected Vendor

Affected Software

run-llama/llama_index
Vulnerable Versions:
unspecified

Timeline

Official Publish: July 10th, 2025
Last Modified: July 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-440

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.