CVE-2024-4148

HIGH

7.5

Description

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerability by maliciously manipulating regular expressions, which can significantly impact the response time of the application and potentially render it completely non-functional. Specifically, the vulnerability can be triggered by sending a specially crafted request to the application, leading to a denial of service where the application crashes.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published6/1/2024

Last Modified1/30/2025

Sourcenvd

Honeypot Sightings0

Affected Products

lunary:lunary

Weaknesses (CWE)

CWE-1333CWE-1333

References

https://github.com/lunary-ai/lunary/commit/1e8a3d941ba5cfef2c478dd5bac4e4a4b4d67830(security@huntr.dev)

https://huntr.com/bounties/eca4ad45-2a38-4f3c-9ec1-8205cd51be31(security@huntr.dev)

https://huntr.com/bounties/eca4ad45-2a38-4f3c-9ec1-8205cd51be31(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.