CVE-2024-9506 - Regular Expression Denial of Service (ReDoS)

LOW

Regular Expression Denial of Service (ReDoS)

Published Oct 15, 2024

2.9

LOW

CVSS 4.0

EPSS 0.53%

Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
2.0.0	affected	<=2.7.16

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	cldr-emoji-annotation	Fix deferred	n/a
Red Hat Enterprise Linux 7	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 7	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux 8	cldr-emoji-annotation	Fix deferred	n/a
Red Hat Enterprise Linux 8	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 8	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux 9	cldr-emoji-annotation	Fix deferred	n/a
Red Hat Enterprise Linux 9	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 9	firefox:flatpak/firefox	Fix deferred	n/a
Red Hat Enterprise Linux 9	gjs	Fix deferred	n/a
Red Hat Enterprise Linux 9	polkit	Fix deferred	n/a
Red Hat Enterprise Linux 9	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux 9	thunderbird:flatpak/thunderbird	Fix deferred	n/a
Red Hat OpenShift Dev Spaces	devspaces/traefik-rhel8	Fix deferred	n/a

Ecosystem	Package	Introduced	Fixed
npm	vue	2.0.0-alpha.1	3.0.0-alpha.0

No remediation recorded yet.

Weaknesses (1)

CWE-1333

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2024-9506		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2318799		Issue Tracking
https://github.com/advisories/GHSA-5j4c-8p2g-v4jx		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-9506
https://www.cve.org/CVERecord?id=CVE-2024-9506
https://www.herodevs.com/vulnerability-directory/cve-2024-9506