Inefficient Regular Expression Complexity
CVE-2024-21490
Summary
This affects the package angular versions 1.3.0-beta.1 through 1.8.3. A Regular Expression used to split the value of the "ng-srcset" directive is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can result in Catastrophic Backtracking and cause a Denial-of-Service (DoS) attack. **Note:** This angular package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core package.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- NONE
- NONE
- HIGH
CWE-1333 - Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
References
Advisory Timeline
- Published