Skip to main content

Uncontrolled Resource Consumption

CVE-2024-43380

High
7.5/10

Summary

The package fugit contains time tools for "flor" and the "floraison" group. The fugit "natural" parser, that turns "every Wednesday at 5pm" into "0 17 * * 3", accepted any length of input and went on attempting to parse it, not returning promptly, as expected. The "parse" call could hold the thread with no end in sight. Fugit dependents that do not check (user) input length for plausibility are impacted. This vulnerability affects fugit package versions prior to 1.11.1.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-400 - Uncontrolled resource consumption

An uncontrolled resource allocation attack (also known as resource exhaustion attack) triggers unauthorized overconsumption of the limited resources in an application, such as memory, file system storage, database connection pool entries, and CPU. This may lead to denial of service for valid users and degradation of the application's functionality as well as that of the host operating system.

References

Advisory Timeline

  • Published