CVE-2024-4068 — Excessive Platform Resource Consumption within a Loop in Braces
Severity
7.5HIGHNVD
EPSS
0.2%
top 57.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 14
Latest updateDec 29
Description
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages12 packages
Patches
🔴Vulnerability Details
4OSV▶
CVE-2024-35928: In the Linux kernel, the following vulnerability has been resolved:
drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()
Thi↗2024-05-19