CVE-2024-21539CWE-1333CWE-770denial-of-service

CVE-2024-21539

High · published November 19, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Weaknesses
CWE-1333 · Inefficient Regular Expression Complexity; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-11-19T10:15Z
References (2)
https://github.com/eslint/rewrite/commit/071be842f0bd58de4863cdf2ab86d60f49912abf · [email protected]https://security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8340627 · [email protected]
EPSS history
Timeline
  • 19 NOV 05:00Z
    Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization
    cvelistv5