CVE-2024-4068: Memory Exhaustion in braces
Memory Exhaustion in braces
Other sources
The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
— GitHub
The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/bracesto a version that resolves this vulnerability.Fixed in 3.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4068?
CVE-2024-4068 has a high severity rating due to its potential for denial of service through memory exhaustion.
How do I fix CVE-2024-4068?
To fix CVE-2024-4068, upgrade the braces package to version 3.0.3 or apply relevant patches for affected IBM products.
What causes CVE-2024-4068?
CVE-2024-4068 is caused by the inability of the braces module to limit the number of characters in input, leading to infinite loops and memory issues.
Which software is affected by CVE-2024-4068?
CVE-2024-4068 affects the braces module in Node.js and IBM Cognos Analytics versions up to 12.0.3 and 11.2.4 FP4.
Is CVE-2024-4068 exploitable remotely?
Yes, CVE-2024-4068 can be exploited remotely if an attacker can send specially crafted imbalanced braces as input.