CVE-2024-4068

Memory Exhaustion in braces

State: Published
Severity: 7.5 High
Published: May 13, 2024
Updated: Nov 6, 2024
Reserved: Apr 23, 2024

Description

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Checkmarx

Weaknesses

CWE-1050 Excessive Platform Resource Consumption within a Loop
CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
bracesmicromatch	3.0.2 and earlierAffectedfrom 3.0.3Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.