Resource exhaustion in Medikoo Es5-Ext
CVE-2024-27088
es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
EPSS exploit prediction
EPSS: 0.005 (42.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 42.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Medikoo Es5-Ext — versions >= 0.10.0, < 0.10.63
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/medikoo/es5-ext/security/advisories/GHSA-4gmj-3p3h-gm8h (Patch, Vendor Advisory)
- github.com/medikoo/es5-ext/issues/201 (Exploit, Issue Tracking)
- github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2 (Patch)
- github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602 (Patch)
Frequently asked questions
- What is CVE-2024-27088?
- CVE-2024-27088 is a vulnerability in Medikoo Es5-Ext, classified under Uncontrolled Resource Consumption. Published 2024-02-26.
- Is CVE-2024-27088 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.