What is CVE-2024-4148?

CVE-2024-4148 is a high-severity vulnerability in Lunary, classified under Inefficient Regular Expression Complexity. CVSS score: 7.5/10. Published 2024-06-01.

How severe is CVE-2024-4148?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Lunary

CVE-2024-4148

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerability by maliciously manipulating regular expressions, which can significantly impact the response time of the application and potentially render it completely non-functional. Specifically, the vulnerability can be triggered by sending a specially crafted request to the application, leading to a denial of service where the application crashes.

Vulnerability class: ReDoS (Regular Expression Denial of Service)

EPSS: 0.006 (44.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Lunary — versions 1.2.10
Lunary-ai Lunary-ai/lunary — versions unspecified

Weakness classification (CWE)

CWE-1333 — Inefficient Regular Expression Complexity

References

security@huntr.dev (Exploit, Third Party Advisory)
security@huntr.dev

Frequently asked questions

What is CVE-2024-4148?: CVE-2024-4148 is a high-severity vulnerability in Lunary, classified under Inefficient Regular Expression Complexity. CVSS score: 7.5/10. Published 2024-06-01.
How severe is CVE-2024-4148?: High severity. CVSS v3 base score is 7.5 out of 10.