CVE-2024-4067
mediumpriority · track · 22EPSS 0.014 · 73 %ileDEEURUUSEPSS · scored 2026-10-23
The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (46)
Products and version ranges known to be affected.
- Red Hat OpenShift CodeReady Workspacesall versionscert_bundDEcpe:/a:redhat:openshift:codeready_workspaces
advisories (6)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-1566IBM QRadar SIEM: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-07-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2024-2036Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenDeutsch2024-09-03csaf · cert_bundDE
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen.
- WID-SEC-W-2024-3674Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2024-12-10csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen oder unspezifische Angriffe durchzuführen.
- WID-SEC-W-2024-3681Atlassian Bitbucket: Mehrere SchwachstellenDeutsch2024-12-10csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in Atlassian Bitbucket ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen.
- WID-SEC-W-2025-0043IBM QRadar SIEM (Log Source Management App): Mehrere SchwachstellenDeutsch2025-01-12csaf · cert_bundDE
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.
- GHSA-952p-6rrq-rcjvRegular Expression Denial of Service (ReDoS) in micromatch2024-05-14ghsa · osvUS
The NPM package `micromatch` prior to version 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persisted prior to https://github.com/micromatch/micromatch/pull/266. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (24)
External citations — patches, advisories, analysis.
- https://advisory.checkmarx.net/advisory/CVE-2024-4067/cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-4067/cnnvd
- https://devhub.checkmarx.com/cve-details/CVE-2024-4067/cnnvd
- https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448cnnvd
- https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2adecnnvd
- https://github.com/micromatch/micromatch/issues/243cnnvd
- https://github.com/micromatch/micromatch/pull/247cnnvd
- https://github.com/micromatch/micromatch/pull/266cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan