CVE-2024-39249

{"id": "CVE-2024-39249", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {}, "published": "2024-07-01T20:15:02.877", "references": [{"url": "https://github.com/caolan/async/blob/v3.2.5/lib/autoInject.js#L41", "source": "cve@mitre.org"}, {"url": "https://github.com/caolan/async/blob/v3.2.5/lib/autoInject.js#L6", "source": "cve@mitre.org"}, {"url": "https://github.com/caolan/async/issues/1975#issuecomment-2204528153", "source": "cve@mitre.org"}, {"url": "https://github.com/zunak/CVE-2024-39249", "source": "cve@mitre.org"}, {"url": "https://github.com/zunak/CVE-2024-39249/issues/1", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. NOTE: this is disputed by the supplier because there is no realistic threat model: regular expressions are not used with untrusted input."}, {"lang": "es", "value": "Async &lt;= 2.6.4 y &lt;= 3.2.5 son vulnerables a ReDoS (Denegaci\u00f3n de servicio de expresi\u00f3n regular) mientras analiza la funci\u00f3n en la funci\u00f3n de autoinyecci\u00f3n."}], "lastModified": "2024-07-09T06:15:01.913", "sourceIdentifier": "cve@mitre.org"}