CVE-2024-21490

ADVISORY - github

Summary

This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.

Note:

This package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core.

EPSS Score: 0.00052 (0.219)

Common Weakness Enumeration (CWE)

ADVISORY - nist

Inefficient Regular Expression Complexity

ADVISORY - github

Inefficient Regular Expression Complexity

ADVISORY - gitlab

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Inefficient Regular Expression Complexity

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

ADVISORY - redhat

Inefficient Regular Expression Complexity


Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.

Sign in