CVE-2024-4068Excessive Platform Resource Consumption within a Loop in Braces

Severity
7.5HIGHNVD
EPSS
0.2%
top 57.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMay 14
Latest updateDec 29

Description

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages12 packages

debiandebian/node-braces< node-braces 3.0.3+~3.0.4-1 (forky)
CVEListV5micromatch/braces3.0.2

Patches

🔴Vulnerability Details

4
OSV
CVE-2024-35928: In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init() Thi2024-05-19
OSV
Uncontrolled resource consumption in braces2024-05-14
OSV
CVE-2024-4068: The NPM package `braces`, versions prior to 32024-05-14
GHSA
Uncontrolled resource consumption in braces2024-05-14

📋Vendor Advisories

5
Red Hat
kernel: f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()2024-12-29
Atlassian
CVE-2024-4068: 9.1.0 9.0.1 to 9.0.3 8.9.0 to 8.9.7 8.8.0 to 8.8.1 8.7.1 to 8.7.2 8.6.0 to 8.6.2 8.5.0 to 8.5.16 (LTS) 8.4.0 to 8.4.5 8.2024-11-19
Microsoft
Memory Exhaustion in braces2024-05-14
Red Hat
braces: fails to limit the number of characters it can handle2024-03-04
Debian
CVE-2024-4068: node-braces - The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of ...2024