CVE-2024-4068
In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.47% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1050, CWE-400
- Affected
- jonschlinkert/braces
- Source
- 596c5446-0ce5-4ba2-aa66-48b3b757a647
References
- https://devhub.checkmarx.com/cve-details/CVE-2024-4068/Third Party Advisory
- https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ffPatch
- https://github.com/micromatch/braces/issues/35Issue Tracking
- https://github.com/micromatch/braces/pull/37Exploit, Issue Tracking, Patch
- https://github.com/micromatch/braces/pull/40Issue Tracking, Patch
- https://devhub.checkmarx.com/cve-details/CVE-2024-4068/Third Party Advisory
- https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ffPatch
- https://github.com/micromatch/braces/issues/35Issue Tracking
- https://github.com/micromatch/braces/pull/37Exploit, Issue Tracking, Patch
- https://github.com/micromatch/braces/pull/40Issue Tracking, Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.