GHSA-4w4v-5hc9-xrr2 CVE-2024-21490
angular vulnerable to super-linear runtime due to backtracking
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.89%
- Chance of exploitation in the next 30 days. Higher than 79.57% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1333 Inefficient Regular Expression Complexity
- Fix
- None yet
- No fixed version published
Description
This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.
Note:
This package is EOL and will not receive any updates to address this issue. Users should migrate to @angular/core.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.webjars.bower:angular | >= 1.3.0, <= 1.8.3 |
No fix yet |
| org.webjars.npm:angular | >= 1.3.0, <= 1.8.3 |
No fix yet |
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| angular | >= 1.3.0, <= 1.8.3 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
References
Advisories
Packages
Other links
- lists.debian.org/debian-lts-announce/2025/07/msg00005.html
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747
- security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113
- stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos
- support.herodevs.com/hc/en-us/articles/25715686953485-CVE-2024-21490-AngularJS-Regular-Ex…
- security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771616
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7x27-g8rg-x87w Angular's deprecated package has a Cross-Site Scripting issue | High | Also affects angular |
| GHSA-j58c-ww9w-pwp5 AngularJS improperly sanitizes SVG elements | Medium | Also affects angular |
| GHSA-mqm9-c95h-x2p6 AngularJS allows attackers to bypass common image source restrictions | Medium | Also affects angular |
| GHSA-m9gf-397r-hwpg AngularJS allows attackers to bypass common image source restrictions | Medium | Also affects angular |
| GHSA-qwqh-hm9m-p5hr angular vulnerable to regular expression denial of service via the <input type="url"> element | Medium | Also affects angular |
| GHSA-2qqx-w9hr-q5gx angular vulnerable to regular expression denial of service via the $resource service | Medium | Also affects angular |
| GHSA-2vrf-hf26-jrp5 angular vulnerable to regular expression denial of service via the angular.copy() utility | Medium | Also affects angular |
| GHSA-prc3-vjfx-vhm9 Angular (deprecated package) Cross-site Scripting | Medium | Also affects angular |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor