CVE-2024-54157

In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector...

CVE-2024-54157

JetBrains YouTrack before 2024.3.52635 is affected by a potential ReDoS due to a vulnerable RegExp in the Ruby syntax detector. The issue is caused by an inefficient regular expression in the Ruby syntax detector component, enabling a Denial of Service under certain inputs. Affected version set i...

path-to-regexp: Backtracking regular expressions cause ReDoS

A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, po...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in path-to-regexp-0.1.7.tgz

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of path-to-regexp-0.1.7.tgz Vulnerability Details CVEID:CVE-2024-45296 DESCRIPTION: pillarjs Path-to-RegExp is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw. By...

Security Bulletin: Denial of service, DNS poisoning, and information disclosure might affect IBM Storage Defender – Resiliency Service

Summary IBM Storage Defender – Resiliency Service is vulnerable and can result in denial of service, DNS poisoning, and information disclosure. The vulnerabilities have been addressed. CVE-2024-34447, CVE-2024-30172, CVE-2024-30171, CVE-2024-29857, CVE-2024-45296, CVE-2023-44487, CVE-2024-29857...

path-to-regexp outputs backtracking regular expressions

...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.16 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.16 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

SUSE CVE-2024-45296

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

GHSA-RRR8-F88R-H8Q6 find-my-way has a ReDoS vulnerability in multiparametric routes

Impact A bad regular expression is generated any time you have two parameters within a single segment, when adding a - at the end, like /:a-:b-. Patches Update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. Workarounds No known workarounds. References - CVE-2024-45296 - Detailed blog po...

find-my-way has a ReDoS vulnerability in multiparametric routes

Impact A bad regular expression is generated any time you have two parameters within a single segment, when adding a - at the end, like /:a-:b-. Patches Update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. Workarounds No known workarounds. References - CVE-2024-45296 - Detailed blog po...

Denial Of Service (DoS)

path-to-regexp is vulnerable to Denial Of Service DoS. The vulnerability is due to the generation of inefficient regular expressions when path strings contain two parameters within a single segment separated by a non-period character, allowing an attacker to cause high CPU usage and potentially...

CVE-2024-45296

A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, po...

07-cesar-router (=0.0.2), 07-custom-router (>=0.0.1 <=0.0.4) +1386 more potentially affected by CVE-2024-45296 via path-to-regexp (>=4.0.3 <=6.2.2)

path-to-regexp NPM version =4.0.3, =0.0.1, =0.0.1, =0.0.1, =0.0.0, =0.0.1, =0.0.0, =0.0.1, =0.0.5, =0.0.1, =0.0.0-canary.0, =0.0.0-canary.6 and more Source cves: CVE-2024-45296 Source advisory: OSV:GHSA-9WV6-86V2-598J...

360shitu (=0.1.0), 3d-crystal-model (=0.1.0) +8361 more potentially affected by CVE-2024-45296 via path-to-regexp (>=2.0.0 <=3.2.0)

path-to-regexp NPM version =2.0.0, =0.24.0, =1.0.0, =1.0.6, =0.0.0-canary.1, =0.0.1, =6.1.5, =1.1.17, =1.2.151 - @21epub/pro-layout =6.10.9 and more Source cves: CVE-2024-45296 Source advisory: OSV:GHSA-9WV6-86V2-598J...

10chars-test (>=1.0.0 <=1.0.34), 128981semzub (=1.0.1) +1463 more potentially affected by CVE-2024-45296 via path-to-regexp (>=0.2.5 <=1.8.0)

path-to-regexp NPM version =0.2.5, =1.0.0, =4.0.61, =4.0.61, =4.0.61, =0.0.3, =0.0.1, =1.1.11, =2.0.0, =0.0.1, =1.0.0, =3.3.9-patch.1, =3.0.0, =3.0.3 and more Source cves: CVE-2024-45296 Source advisory: OSV:GHSA-9WV6-86V2-598J...

06-react-router-myself (>=0.0.1 <=0.0.2), 07-building-a-router (>=0.0.1 <=0.0.2) +194 more potentially affected by CVE-2024-45296 via path-to-regexp (>=7.0.0 <=7.2.0)

path-to-regexp NPM version =7.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =5.0.0, =2.13.21, =8.0.0, =4.0.34, =15.0.10, =4.0.0, =10.5.0, =0.0.9, =9.0.0, =9.5.0, =9.5.36 and more Source cves: CVE-2024-45296 Source advisory: OSV:GHSA-9WV6-86V2-598J...

@betit/orion (>=0.1.3 <=0.1.17), @nichoth/router (>=0.0.0 <=0.0.2) +124 more potentially affected by CVE-2024-45296 via path-to-regexp (>=0.0.2 <=0.1.0)

path-to-regexp NPM version =0.0.2, =0.1.3, =0.0.0, =0.0.0, =0.0.1, =0.0.9-beta.1, =0.0.2, =2.0.0, =0.2.0, =0.0.1, =0.0.1, =1.0.6, =0.1.1, =0.1.2 and more Source cves: CVE-2024-45296 Source advisory: OSV:GHSA-9WV6-86V2-598J...

CVE-2024-45296

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

AZL-49161 CVE-2024-45296 affecting package nodejs-nodemon 2.0.3-5

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

AZL-49117 CVE-2024-45296 affecting package reaper for versions less than 3.1.1-13

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...