CVE-2026-44843High· 8.2▾ TwilightA flaw was found in LangChain, a framework for building agents and large language model (LLM)-powered applications. Older runtime code paths within LangChain deserialize application-controlled payloads using overly broad object allowlists.…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
Last analysed / modified upstream
A flaw was found in LangChain, a framework for building agents and large language model (LLM)-powered applications. Older runtime code paths within LangChain deserialize application-controlled payloads using overly broad object allowlists. A remote attacker can exploit this by supplying specially crafted LangChain serialized constructor dictionaries, leading to the instantiation of classes with untrusted arguments. This can result in the disclosure of sensitive information and potential partial compromise of data integrity.
langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization — rated Important by Red Hat. Released 2026-05-26, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:43038 For Red Hat OpenShift AI 3.3.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:73987 For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:60520
Workarounds / mitigations:
Affected packages:
langchain-core >= 1.0.0, < 1.3.3langchain-core < 0.3.85Patched in:
langchain-core 1.3.3langchain-core 0.3.85Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59884Medium· 5.9python-pyasn1: pyasn1: Denial of Service via crafted BER input (CVE-2026-59884)
CVE-2026-59885High· 7.5pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885)
CVE-2026-34993High· 7.2aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993)
CVE-2026-5422Medium· 6.8jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability (CVE-2026-5422)
CVE-2026-54283High· 7.5starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS (CVE-2026-54283)
CVE-2026-80205High· 7.5nltk: NLTK: Denial of Service via unvalidated regular expressions (CVE-2026-80205)