// For flags

CVE-2024-4068

Memory Exhaustion in braces

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

El paquete NPM "braces" no limita la cantidad de caracteres que puede manejar, lo que podría provocar agotamiento de la memoria. En `lib/parse.js`, si un usuario malintencionado envía "imbalanced braces" como entrada, el análisis entrará en un bucle, lo que hará que el programa comience a asignar memoria de montón sin liberarla en ningún momento del bucle. Finalmente, se alcanza el límite del montón de JavaScript y el programa fallará.

A flaw was found in the NPM package `braces.` It fails to limit the number of characters it can handle, which could lead to memory exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, causing the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

*Credits: Mário Teixeira, Checkmarx Research Group
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-04-23 CVE Reserved
  • 2024-05-13 CVE Published
  • 2024-05-14 EPSS Updated
  • 2024-11-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-400: Uncontrolled Resource Consumption
  • CWE-1050: Excessive Platform Resource Consumption within a Loop
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Micromatch
Search vendor "Micromatch"
 Braces
Search vendor "Micromatch" for product "Braces"
 <= 3.0.2
Search vendor "Micromatch" for product "Braces" and version " <= 3.0.2"
en
Affected