{"id":"CVE-2025-21604","summary":"LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts","details":"LangChain4j-AIDeepin is a Retrieval enhancement generation (RAG) project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0.","aliases":["GHSA-cv5r-73vf-8x7v"],"modified":"2026-08-12T15:13:20.712422Z","published":"2025-01-06T15:34:54.794Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-328"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21604.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21604.json"},{"type":"ADVISORY","url":"https://github.com/moyangzhan/langchain4j-aideepin/security/advisories/GHSA-cv5r-73vf-8x7v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21604"},{"type":"FIX","url":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/moyangzhan/langchain4j-aideepin","events":[{"introduced":"0"},{"fixed":"3cf625c5044a151a8cbcbdf98e10b4b46b8a975a"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"3.5.0"}]}}],"versions":["v3.4.0","v3.3.0","v3.2.0","v3.1.0","v3.0.0","v2.9.1","v2.9.0","v2.8.1","v2.8.0","v2.7.0","v2.6.3","v2.6.2","v2.6.1","v2.6.0","v2.5.0","v2.4.1","v2.4.0","v2.3.1","v2.3.0","v2.2.1","v2.2.0","v2.1.0","v2.0.1","v2.0.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21604.json","vanir_signatures_modified":"2026-08-12T15:13:20Z","vanir_signatures":[{"id":"CVE-2025-21604-00d97fb4","signature_type":"Function","signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-common/src/main/java/com/moyz/adi/common/service/ConversationService.java","function":"addByPresetConv"},"deprecated":false,"digest":{"function_hash":"7452475394136434798293036918444845082","length":943}},{"signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-common/src/main/java/com/moyz/adi/common/service/ConversationService.java","function":"add"},"deprecated":false,"digest":{"function_hash":"204577787752390833512616283562562693276","length":722},"id":"CVE-2025-21604-05596133","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["61383702886949006192394734930945118308","187431594854799051888789516745105194735","94481120426140143347774311515753539093","67011139199395466529945639161645994449","80695339611011367942370917069239568128","57777124343648361095463627143605925490","206844810267730878573859149677257765676","269863157501011299835339990075864696414","323336060275859628209215380722232947660","29185053539862057927870652621246876500","219092474404381116476139804769610592178","222538655982720857201241515076400550674","257718756778131460446761724414746664000","230235769791325056407630361352548322333","215207012982538227270473694761074121340","100833538146816870463964989367285517879","132754045805134848507129892551268722343","272814052604381429735179762873095464444","69531666076644250583325748215522211546","239885776184526241340478335954056147705","1944473491775840794668933772123856322","67872448439544076986518778967275015166","304039008954426990609511009012502699605","64143130660725228275783235059812054847","270607623297472337812502041431549036356","191326809903498544373393641357985310049","132854499506778854170900540152684958123","157642473973725710060748296970799261201","108359096223031641617831659926889711120","296801186652902002155219069969010717070","185026291912079403253849821069129531343","279751031622999103415296839246534647208","115888907771787030136106636190070230964","285439745101018965023614827059187376790","175857191533585632510682244459187917753","239382716081715606049027478960007312858","326408734805616858860623060257002877712","128380402220290471445340162667088764737"],"threshold":0.9},"id":"CVE-2025-21604-1fd2a2ae","signature_type":"Line","signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-common/src/main/java/com/moyz/adi/common/service/FileService.java"}},{"digest":{"line_hashes":["100265552567848686992653224625016317831","220101814524855639176926816049357139515","29481775147923841512079850669559296140","121755938279291864434726323695755749734"],"threshold":0.9},"id":"CVE-2025-21604-34b1d45f","signature_type":"Line","signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-chat/src/main/java/com/moyz/adi/chat/controller/ConversationController.java"},"deprecated":false},{"target":{"file":"adi-common/src/main/java/com/moyz/adi/common/enums/ErrorEnum.java"},"deprecated":false,"digest":{"line_hashes":["101123352693917577174785973717139888328","305123991302335675393259032143984341323","37758706124125230627448108721614018398","127023554281141374989462279468255324161","94494717813872649769019876503305600171","127566916773622591975314591199377738140","77272487449769259676376510223662971290"],"threshold":0.9},"id":"CVE-2025-21604-5253fcba","signature_type":"Line","signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a"},{"deprecated":false,"digest":{"line_hashes":["18774409005088105463755904783482070432","10611842711013007367215119589873777400","187964482370308211763974331481318602952"],"threshold":0.9},"id":"CVE-2025-21604-5e1c114f","signature_type":"Line","signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-common/src/main/java/com/moyz/adi/common/entity/Conversation.java"}},{"source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-common/src/main/java/com/moyz/adi/common/service/FileService.java","function":"saveImageToLocal"},"deprecated":false,"digest":{"function_hash":"291293327780613552229482644717179202268","length":653},"id":"CVE-2025-21604-7ae5cfd2","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-common/src/main/java/com/moyz/adi/common/util/TriConsumer.java"},"deprecated":false,"digest":{"line_hashes":["47603105274481758439656371733398783094","192816907096735203384771903780427503331"],"threshold":0.9},"id":"CVE-2025-21604-9795f26a","signature_type":"Line"},{"target":{"file":"adi-common/src/main/java/com/moyz/adi/common/service/FileService.java","function":"writeToLocal"},"deprecated":false,"digest":{"function_hash":"316457506815565558121775696848017133653","length":1070},"id":"CVE-2025-21604-a1e20e07","signature_type":"Function","signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a"},{"digest":{"line_hashes":["190992700568909449938370093527798806672","133360341981303255712142114399863777651","251977814130554359438536451284950549768","180098339674983093176587310329141908206","138365701794902789802307587204706529436","128543645234366998819525425799902815765","195034723152252202815766840092148740759","34349032610514901981132467388717631293","281843541973402195673596179972525961571","185864031017211585984754857457032384308"],"threshold":0.9},"id":"CVE-2025-21604-a93cfa41","signature_type":"Line","signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-common/src/main/java/com/moyz/adi/common/entity/AdiFile.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-common/src/main/java/com/moyz/adi/common/service/FileService.java","function":"removeFileAndSoftDel"},"deprecated":false,"digest":{"length":461,"function_hash":"233269545014562707707778863308449206128"},"id":"CVE-2025-21604-b127e05a","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-common/src/main/java/com/moyz/adi/common/service/ConversationService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["294933300370244347266967012778010582886","132416457929869329018299066479534008981","132370986354569149240525107157753989332","98587126735706325654682075515507493023","50764866796041675131557422755860402712","325453351672323100823411293681533518292","255188776978260794725105997152671519958","37731614918365132146838546460113467735","328107744087573051541260305112665602798","96541853767596086075699428491390017392","103630523033160022879170246647908631633","171392437556374710216128046930137508159"]},"id":"CVE-2025-21604-bd961c47","signature_type":"Line"},{"id":"CVE-2025-21604-e92bdfa2","signature_type":"Line","signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-common/src/main/java/com/moyz/adi/common/dto/ConvEditReq.java"},"deprecated":false,"digest":{"line_hashes":["77746251614731004716469719344714783099","330520698220928338519382132879887815689","200710305028005346219403810287331932984"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"function":"readImage","file":"adi-common/src/main/java/com/moyz/adi/common/service/FileService.java"},"deprecated":false,"digest":{"function_hash":"26377632221205769163219109376574279937","length":555},"id":"CVE-2025-21604-e94953e7","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a","target":{"file":"adi-common/src/main/java/com/moyz/adi/common/dto/ConvAddReq.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["62819505112023543639989399824492283501","191703437005536584930961985760934504048","83196985312863567416509001477129003451"]},"id":"CVE-2025-21604-eddec64b"},{"target":{"file":"adi-chat/src/main/java/com/moyz/adi/chat/controller/ConversationController.java","function":"add"},"deprecated":false,"digest":{"function_hash":"183686825470764290047130155643663245419","length":148},"id":"CVE-2025-21604-fa1a18de","signature_type":"Function","signature_version":"v1","source":"https://github.com/moyangzhan/langchain4j-aideepin/commit/3cf625c5044a151a8cbcbdf98e10b4b46b8a975a"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}