CVE-2024-39249: High severity Async Async vulnerability
Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function.
Other sources
Async is vulnerable to a denial of service, caused by the ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service. Note: This vulnerability is disputed by the supplier because there is no realistic threat model: regular expressions are not used with untrusted input.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39249?
CVE-2024-39249 has a high severity due to its potential to lead to Denial of Service conditions.
How do I fix CVE-2024-39249?
To fix CVE-2024-39249, upgrade to Async version 2.6.5 or higher, or to 3.2.6 or higher.
What types of systems are affected by CVE-2024-39249?
CVE-2024-39249 affects systems running Async versions 2.6.4 and 3.2.5 or earlier.
What is a ReDoS attack in relation to CVE-2024-39249?
A ReDoS attack exploits the vulnerability in CVE-2024-39249 to consume excessive processing time, causing system slowdown or crashes.
What is the primary vulnerability in CVE-2024-39249?
The primary vulnerability in CVE-2024-39249 lies in how Async processes regular expressions in the autoinject function.