Vulnerability-Lookup

CVE-2024-9506 (GCVE-0-2024-9506)

Vulnerability from cvelistv5 – Published: 2024-10-15 15:40 – Updated: 2024-10-15 16:10

Title

Regular Expression Denial of Service (ReDoS)

Summary

Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 16:10 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

HeroDevs mitre root

References

1 reference

URL	Tags
https://www.herodevs.com/vulnerability-directory/…

Impacted products

1 product

Vendor	Product	Version	CPE status
vue	vue	Affected: 2.0.0 , ≤ 2.7.16 (semver)	guessed

Credits

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9506",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T16:10:46.075149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T16:10:56.576Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vue",
          "vendor": "vue",
          "versions": [
            {
              "lessThanOrEqual": "2.7.16",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "K"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability."
            }
          ],
          "value": "Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-492",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-492 Regular Expression Exponential Blowup"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T15:40:04.627Z",
        "orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "shortName": "HeroDevs"
      },
      "references": [
        {
          "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-9506"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Regular Expression Denial of Service (ReDoS)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
    "assignerShortName": "HeroDevs",
    "cveId": "CVE-2024-9506",
    "datePublished": "2024-10-15T15:40:04.627Z",
    "dateReserved": "2024-10-03T22:32:46.410Z",
    "dateUpdated": "2024-10-15T16:10:56.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-9506",
      "date": "2026-09-17",
      "epss": "0.00528",
      "percentile": "0.43478"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability.\"}, {\"lang\": \"es\", \"value\": \"Una expresi\\u00f3n regular incorrecta en la funci\\u00f3n parseHTML de Vue conduce a una posible vulnerabilidad de denegaci\\u00f3n de servicio de expresi\\u00f3n regular.\"}]",
      "id": "CVE-2024-9506",
      "lastModified": "2024-10-16T16:38:43.170",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"baseScore\": 3.7, \"baseSeverity\": \"LOW\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 1.4}]}",
      "published": "2024-10-15T16:15:06.650",
      "references": "[{\"url\": \"https://www.herodevs.com/vulnerability-directory/cve-2024-9506\", \"source\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\"}]",
      "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-1333\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-9506\",\"sourceIdentifier\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"published\":\"2024-10-15T16:15:06.650\",\"lastModified\":\"2026-06-17T08:24:42.310\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability.\"},{\"lang\":\"es\",\"value\":\"Una expresi\u00f3n regular incorrecta en la funci\u00f3n parseHTML de Vue conduce a una posible vulnerabilidad de denegaci\u00f3n de servicio de expresi\u00f3n regular.\"}],\"affected\":[{\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"affectedData\":[{\"vendor\":\"vue\",\"product\":\"vue\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"2.0.0\",\"lessThanOrEqual\":\"2.7.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.2,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-15T16:10:46.075149Z\",\"id\":\"CVE-2024-9506\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1333\"}]}],\"references\":[{\"url\":\"https://www.herodevs.com/vulnerability-directory/cve-2024-9506\",\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T07:49:26+00:00",
      "cve": "CVE-2024-9506",
      "id": "CVE-2024-9506",
      "initial_release_date": "2024-10-15T15:40:04.627000+00:00",
      "product_status:known_affected": "30",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "vue: Regular Expression Denial of Service (ReDoS)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-9506.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-9506\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-15T16:10:46.075149Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-15T16:10:50.594Z\"}}], \"cna\": {\"title\": \"Regular Expression Denial of Service (ReDoS)\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"K\"}], \"impacts\": [{\"capecId\": \"CAPEC-492\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-492 Regular Expression Exponential Blowup\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"vue\", \"product\": \"vue\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.7.16\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.herodevs.com/vulnerability-directory/cve-2024-9506\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1333\", \"description\": \"CWE-1333 Inefficient Regular Expression Complexity\"}]}], \"providerMetadata\": {\"orgId\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"shortName\": \"HeroDevs\", \"dateUpdated\": \"2024-10-15T15:40:04.627Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-9506\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-15T16:10:56.576Z\", \"dateReserved\": \"2024-10-03T22:32:46.410Z\", \"assignerOrgId\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"datePublished\": \"2024-10-15T15:40:04.627Z\", \"assignerShortName\": \"HeroDevs\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-9506

Vulnerability from fkie_nvd - Published: 2024-10-15 16:15 - Updated: 2026-06-17 08:24

Severity

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.

References

	URL	Tags
	36c7be3b-2937-45df-85ea-ca7133ea542c	https://www.herodevs.com/vulnerability-directory/cve-2024-9506

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "vue",
          "vendor": "vue",
          "versions": [
            {
              "lessThanOrEqual": "2.7.16",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper regular expression in Vue\u0027s parseHTML function leads to a potential regular expression denial of service vulnerability."
    },
    {
      "lang": "es",
      "value": "Una expresi\u00f3n regular incorrecta en la funci\u00f3n parseHTML de Vue conduce a una posible vulnerabilidad de denegaci\u00f3n de servicio de expresi\u00f3n regular."
    }
  ],
  "id": "CVE-2024-9506",
  "lastModified": "2026-06-17T08:24:42.310",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-9506",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-10-15T16:10:46.075149Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-10-15T16:15:06.650",
  "references": [
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-9506"
    }
  ],
  "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "type": "Secondary"
    }
  ]
}

GHSA-5J4C-8P2G-V4JX

Vulnerability from github – Published: 2024-10-15 18:30 – Updated: 2024-10-24 18:42

Summary

ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function

Details

The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.

To demonstrate this vulnerability, here's an example. In a Vue client-side application, create a new Vue instance with a template string that includes a <script> tag but closes it incorrectly with something like </textarea>.

new Vue({
  el: '#app',
  template: '
    <div>
      Hello, world!
      <script>${'<'.repeat(1000000)}</textarea>
    </div>'
});

Next, set up a basic HTML page (e.g., index.html) to load this JavaScript and mount the Vue instance:

<!DOCTYPE html>
<html>
<head>
  <title>My first Vue app</title>
</head>
<body>
  <div id=\"app\">Loading...</div>
</body>
</html>

When you visit the app in your browser at http://localhost:3000, you'll notice that the time taken to parse and mount the Vue application increases significantly due to the ReDoS vulnerability, demonstrating how the flaw can affect performance.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

2.9 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "vue"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-alpha.1"
            },
            {
              "fixed": "3.0.0-alpha.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-9506"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-24T18:42:59Z",
    "nvd_published_at": "2024-10-15T16:15:06Z",
    "severity": "LOW"
  },
  "details": "The ReDoS can be exploited through the `parseHTML` function in the `html-parser.ts` file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption.\n\nTo demonstrate this vulnerability, here\u0027s an example. In a Vue client-side application, create a new Vue instance with a template string that includes a `\u003cscript\u003e` tag but closes it incorrectly with something like `\u003c/textarea\u003e`.\n\n```javascript\nnew Vue({\n  el: \u0027#app\u0027,\n  template: \u0027\n    \u003cdiv\u003e\n      Hello, world!\n      \u003cscript\u003e${\u0027\u003c\u0027.repeat(1000000)}\u003c/textarea\u003e\n    \u003c/div\u003e\u0027\n});\n```\nNext, set up a basic HTML page (e.g., index.html) to load this JavaScript and mount the Vue instance:\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n  \u003ctitle\u003eMy first Vue app\u003c/title\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n  \u003cdiv id=\\\"app\\\"\u003eLoading...\u003c/div\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\nWhen you visit the app in your browser at http://localhost:3000, you\u0027ll notice that the time taken to parse and mount the Vue application increases significantly due to the ReDoS vulnerability, demonstrating how the flaw can affect performance.",
  "id": "GHSA-5j4c-8p2g-v4jx",
  "modified": "2024-10-24T18:42:59Z",
  "published": "2024-10-15T18:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9506"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vuejs/core"
    },
    {
      "type": "WEB",
      "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-9506"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-9506 (GCVE-0-2024-9506)

FKIE_CVE-2024-9506

GHSA-5J4C-8P2G-V4JX

Tags

Sightings

Nomenclature

Related by attack behaviour