CVE-2024-21490: High severity angular vulnerability
This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.
Note:
This package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core.
Other sources
This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. Note: This package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21490?
CVE-2024-21490 is classified as a denial of service vulnerability due to potential catastrophic backtracking in regular expressions.
How do I fix CVE-2024-21490?
To fix CVE-2024-21490, upgrade the Angular package to a version higher than 1.8.3.
What versions are affected by CVE-2024-21490?
CVE-2024-21490 affects Angular versions from 1.3.0 to 1.8.3.
What is the impact of CVE-2024-21490?
The impact of CVE-2024-21490 is a potential denial of service due to performance degradation from super-linear runtime.
Which Angular packages are affected by CVE-2024-21490?
CVE-2024-21490 affects angular packages from org.webjars.bower, org.webjars.npm, and npm for Angular.