CVE-2024-10955

Katalog CVE

CVSS 6.5 · Medium EPSS 0,75%

Kerentanan Inefficient Regular Expression Complexity pada gaizhenbiao chuanhuchatgpt. Skor CVSS 3.0 6.5 (Medium) menurut huntr.dev.

Deskripsi (NVD)

A Regular Expression Denial of Service (ReDoS) vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern `r'<[^>]+>'` to parse user input. In Python's default regex engine, this pattern can take polynomial time to match certain crafted inputs. An attacker can exploit this by uploading a malicious JSON payload, causing the server to consume 100% CPU for an extended period. This can lead to a Denial of Service (DoS) condition, potentially affecting the entire server.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.0

6.5 (Medium), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/8291f8d0-5060-47e7-9986-1f411310fb7b exploit · advisory pihak ketiga