CVE-2024-4068

🗓️ 14 May 2024 15:42:00Reported by ubuntu.comType

ubuntucve

ubuntucve🔗 ubuntu.com👁 30 Views

NPM package 'braces' fails to limit character input, causing Memory Exhaustion in parse.j

Reporter	Title	Published	Views	Family All 168
IBM Security Bulletins	Security Bulletin: IBM Security QRadar EDR Software contains multiple vulnerabilities	8 Jul 202409:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics Mobile (Android) is affected by multiple vulnerabilities	21 Oct 202415:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js braces	29 Jul 202421:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	6 May 202519:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is using components with known vulnerabilities	9 Jul 202417:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (February 2025)	15 Apr 202503:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Information Queue	5 Aug 202409:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Node.js micromatch & braces modules (CVE-2024-4067 & CVE-2024-4068)	14 Jun 202410:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	15 Apr 202502:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js braces module denial of service vulnerability [ CVE-2024-4068]	28 Jan 202522:08	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	18.04	any	node-braces	0	node-braces_0_any.deb
Ubuntu	22.04	any	node-braces	0	node-braces_0_any.deb
Ubuntu	24.04	any	node-braces	0	node-braces_0_any.deb
Ubuntu	26.04	any	node-braces	0	node-braces_0_any.deb
Ubuntu	25.10	any	node-braces	0	node-braces_0_any.deb

Source	Link
cve	www.cve.org/CVERecord
github	www.github.com/micromatch/braces/issues/35
devhub	www.devhub.checkmarx.com/cve-details/CVE-2024-4068/
github	www.github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js

11 Jul 2025 07:58Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.5

EPSS0.01471

SSVC

npm package memory exhaustion parse.js javascript heap limit program crash unix