CVE-2024-52798: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
Impact
The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296
Patches
Upgrade to 0.1.12.
Workarounds
Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.
References
- https://github.com/advisories/GHSA-9wv6-86v2-598j - https://blakeembrey.com/posts/2024-09-web-redos/
Other sources
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52798?
CVE-2024-52798 has a moderate severity due to the potential for Denial of Service from backtracking in regular expressions.
How do I fix CVE-2024-52798?
To fix CVE-2024-52798, upgrade the 'path-to-regexp' package to version 0.1.12 or later.
What software is affected by CVE-2024-52798?
CVE-2024-52798 affects versions before 0.1.12 of the 'path-to-regexp' package.
What is the cause of CVE-2024-52798?
CVE-2024-52798 is caused by a vulnerable regular expression that allows for excessive backtracking.
Are there workarounds for CVE-2024-52798?
As a workaround for CVE-2024-52798, avoid using two parameters within a single path segment.