CVE-2024-4068

Katalog CVE

CVSS 7.5 · High EPSS 1,5%

Kerentanan Excessive Platform Resource Consumption within a Loop pada jonschlinkert braces. Skor CVSS 3.1 7.5 (High) menurut CNA.

Deskripsi (NVD)

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Rincian

Terbit di NVD

14 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1050: Excessive Platform Resource Consumption within a Loop
CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff patch
• https://github.com/micromatch/braces/pull/37 exploit · issue tracking · patch
• https://github.com/micromatch/braces/pull/40 issue tracking · patch
• https://devhub.checkmarx.com/cve-details/CVE-2024-4068/ advisory pihak ketiga
• https://github.com/micromatch/braces/issues/35 issue tracking