Uncontrolled Memory Allocation in Braces - CVE-2024-4068
Published: June 20, 2024
Vulnerability identifier: #VU92405
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2024-4068
CWE-ID: CWE-789
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: micromatch
Affected software:
Braces
Braces
Detailed vulnerability description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. A remote attacker can send "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
How to mitigate CVE-2024-4068
Install updates from vendor's website.