Skip to main content

Inefficient Regular Expression Complexity

CVE-2024-21490

High
7.5/10

Summary

This affects the package angular versions 1.3.0-beta.1 through 1.8.3. A Regular Expression used to split the value of the "ng-srcset" directive is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can result in Catastrophic Backtracking and cause a Denial-of-Service (DoS) attack. **Note:** This angular package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core package.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published