CVE-2024-41818: ReDOS at currency parsing fast-xml-parser
Summary A ReDOS that exists on currency.js was discovered by Gauss Security Labs R&D team.
Details https://github.com/NaturalIntelligence/fast-xml-parser/blob/v4.4.0/src/v5/valueParsers/currency.js#L10 contains a vulnerable regex
PoC pass the following string '\t'.repeat(13337) + '.'
Impact Denial of service during currency parsing in experimental version 5 of fast-xml-parser-library
https://gauss-security.com
Other sources
fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.
— MITRE
Natural Intelligence fast-xml-parser is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the currency.js script. By sending a specially crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41818?
CVE-2024-41818 has a moderate severity level due to the potential for a Regular Expression Denial of Service (ReDOS).
How do I fix CVE-2024-41818?
To fix CVE-2024-41818, update the fast-xml-parser package to version 4.4.1 or later.
Which versions of fast-xml-parser are affected by CVE-2024-41818?
CVE-2024-41818 affects fast-xml-parser versions from 4.3.5 up to 4.4.0, as well as version 4.2.4.
What type of vulnerability is CVE-2024-41818?
CVE-2024-41818 is classified as a Regular Expression Denial of Service (ReDOS) vulnerability.
Who discovered CVE-2024-41818?
CVE-2024-41818 was discovered by the Gauss Security Labs R&D team.