Inefficient Regular Expression Complexity
CVE-2024-39249
Summary
The package async versions are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in the "autoinject" function. NOTE: this is disputed by the supplier because there is no realistic threat model: regular expressions are not used with untrusted input.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- NONE
- NONE
- LOW
CWE-1333 - Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
References
Advisory Timeline
- Published