Vulnerability Description
A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. The server uses the regex /{.*?}/ to match user-controlled strings. In the default JavaScript regex engine, this regex can take polynomial time to match certain crafted user inputs. As a result, an attacker can cause the server to hang for an arbitrary amount of time by submitting a specially crafted payload. This issue is fixed in version 1.4.26.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lunary | Lunary | < 1.4.26 |
Related Weaknesses (CWE)
References
- https://github.com/lunary-ai/lunary/commit/f2bfa036caf2c48686474f4560a9c5abcf5f4Patch
- https://huntr.com/bounties/4dbd8648-1dca-4f95-b74f-978ef030e97eExploit
- https://huntr.com/bounties/4dbd8648-1dca-4f95-b74f-978ef030e97eExploit
FAQ
What is CVE-2024-8998?
CVE-2024-8998 is a vulnerability with a CVSS score of 7.5 (HIGH). A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. The server uses the regex /{.*?}/ to match user-controlled strings. In the default JavaScri...
How severe is CVE-2024-8998?
CVE-2024-8998 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-8998?
Check the references section above for vendor advisories and patch information. Affected products include: Lunary Lunary.