CVE-2024-8789CWE-1333

Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary

High · published March 20, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
56.9
In the wild
Unconfirmed
What it is

Lunary-ai/lunary version git 105a3f6 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. The application allows users to upload their own regular expressions, which are then executed on the server side. Certain regular expressions can have exponential runtime complexity relative to the input size, leading to potential denial of service. An attacker can exploit this by submitting a specially crafted regular expression, causing the server to become unresponsive for an arbitrary length of time.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00824 · 56.9th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2025-03-20T10:10Z
EPSS history
Timeline
  • 20 MAR 10:10Z
    Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary
    cvelistv5