// For flags

CVE-2024-45296

path-to-regexp outputs backtracking regular expressions

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a denial of service (DoS).

Red Hat Advanced Cluster Management for Kubernetes 2.11.4 General Availability release images, which provide enhancements, bug fixes, and updated container images. Issues addressed include cross site scripting and denial of service vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-08-26 CVE Reserved
  • 2024-09-09 CVE Published
  • 2024-09-09 CVE Updated
  • 2024-09-10 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-1333: Inefficient Regular Expression Complexity
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Pillarjs
Search vendor "Pillarjs"
 Path-to-regexp
Search vendor "Pillarjs" for product "Path-to-regexp"
 < 0.1.10
Search vendor "Pillarjs" for product "Path-to-regexp" and version " < 0.1.10"
en
Affected
Pillarjs
Search vendor "Pillarjs"
 Path-to-regexp
Search vendor "Pillarjs" for product "Path-to-regexp"
 >= 0.2.0 < 8.0.0
Search vendor "Pillarjs" for product "Path-to-regexp" and version " >= 0.2.0 < 8.0.0"
en
Affected