Async Security Vulnerabilities

🗓️ 01 Jul 2024 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 1 Views

Security vulnerability in Async versions 2.6.4 and earlier and 3.2.5 and earlier allows ReDoS during auto-injected function parsing.

Reporter	Title	Published	Views	Family All 34
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	30 Sep 202416:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in the Async package affect IBM® Db2® Big SQL on IBM Cloud Pak for Data.	25 Jan 202612:00	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Async, IBM Event Streams is vulnerable to Regular Expression denial of service	12 Nov 202410:26	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Async, IBM Event Processing is vulnerable to Regular Expression Denial of Service	12 Nov 202410:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Endpoint Management	12 Nov 202410:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities which can affect IBM Storage Scale are now fixed.	9 Dec 202418:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for September and October 2024.	15 Apr 202502:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.5 addresses multiple security vulnerabilities.	3 Feb 202523:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in async	24 Oct 202422:31	–	ibm

Source	Link
github	www.github.com/caolan/async/blob/v3.2.5/lib/autoInject.js
github	www.github.com/caolan/async/blob/v3.2.5/lib/autoInject.js
github	www.github.com/zunak/CVE-2024-39249
github	www.github.com/zunak/CVE-2024-39249/issues/1
github	www.github.com/caolan/async/issues/1975
cxsecurity	www.cxsecurity.com/cveshow/CVE-2024-39249/
access	www.access.redhat.com/security/cve/cve-2024-39249
vigilance	www.vigilance.fr/vulnerability/Async-overload-via-Autoinject-Function-47227

31 Dec 2025 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5

EPSS0.00812

SSVC

Async library Regular expression vulnerability Auto injected functions Version 2.6.4 Version 3.2.5