CVE-2024-9506 - OpenCVE

Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2024-9506
https://www.cve.org/CVERecord?id=CVE-2024-9506
https://www.herodevs.com/vulnerability-directory/cve-2024-9506

History

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00037}`	epss `{'score': 0.00051}`

Wed, 16 Oct 2024 01:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2024-9506 https://www.cve.org/CVERecord?id=CVE-2024-9506
Metrics	threat_severity `None`	threat_severity `Low`

Tue, 15 Oct 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 15 Oct 2024 15:45:00 +0000

Type	Values Removed	Values Added
Description		Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.
Title		Regular Expression Denial of Service (ReDoS)
Weaknesses		CWE-1333
References		https://www.herodevs.com/vulnerability-directory/cve-2024-9506
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: HeroDevs

Published: 2024-10-15T15:40:04.627Z

Updated: 2024-10-15T16:10:56.576Z

Reserved: 2024-10-03T22:32:46.410Z

Link: CVE-2024-9506

Vulnrichment

Updated: 2024-10-15T16:10:50.594Z

NVD

Status : Awaiting Analysis

Published: 2024-10-15T16:15:06.650

Modified: 2024-10-16T16:38:43.170

Link: CVE-2024-9506

Redhat

Severity : Low

Publid Date: 2024-10-15T15:40:04Z

Links: CVE-2024-9506 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9506", "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "state": "PUBLISHED", "assignerShortName": "HeroDevs", "dateReserved": "2024-10-03T22:32:46.410Z", "datePublished": "2024-10-15T15:40:04.627Z", "dateUpdated": "2024-10-15T16:10:56.576Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "vue", "vendor": "vue", "versions": [{"lessThanOrEqual": "2.7.16", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "K"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability."}], "value": "Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability."}], "impacts": [{"capecId": "CAPEC-492", "descriptions": [{"lang": "en", "value": "CAPEC-492 Regular Expression Exponential Blowup"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "description": "CWE-1333 Inefficient Regular Expression Complexity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "shortName": "HeroDevs", "dateUpdated": "2024-10-15T15:40:04.627Z"}, "references": [{"url": "https://www.herodevs.com/vulnerability-directory/cve-2024-9506"}], "source": {"discovery": "UNKNOWN"}, "title": "Regular Expression Denial of Service (ReDoS)", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T16:10:46.075149Z", "id": "CVE-2024-9506", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T16:10:56.576Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9506", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-15T16:10:46.075149Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T16:10:50.594Z"}}], "cna": {"title": "Regular Expression Denial of Service (ReDoS)", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "K"}], "impacts": [{"capecId": "CAPEC-492", "descriptions": [{"lang": "en", "value": "CAPEC-492 Regular Expression Exponential Blowup"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "vue", "product": "vue", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "2.7.16"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.herodevs.com/vulnerability-directory/cve-2024-9506"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.", "supportingMedia": [{"type": "text/html", "value": "Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333 Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "shortName": "HeroDevs", "dateUpdated": "2024-10-15T15:40:04.627Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9506", "state": "PUBLISHED", "dateUpdated": "2024-10-15T16:10:56.576Z", "dateReserved": "2024-10-03T22:32:46.410Z", "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "datePublished": "2024-10-15T15:40:04.627Z", "assignerShortName": "HeroDevs"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "vue: Regular Expression Denial of Service (ReDoS)", "id": "2318799", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318799"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-1333", "details": ["Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.", "A flaw was found in Vue.js. Within the parseHTML() function of html-parser.ts, there is a regular expression (regex) to check for proper closing tags for HTML. However, due to an improperly written regex, when you pass a script containing long text, it will trigger a regular expression denial of service (ReDoS) attack, which can cause the process to slow down significantly and render the application unavailable."], "name": "CVE-2024-9506", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "cldr-emoji-annotation", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "cldr-emoji-annotation", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "cldr-emoji-annotation", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "firefox:flatpak/firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "gjs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "polkit", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "thunderbird:flatpak/thunderbird", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3:", "fix_state": "Fix deferred", "package_name": "devspaces/traefik-rhel8", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2024-10-15T15:40:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-9506\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-9506\nhttps://www.herodevs.com/vulnerability-directory/cve-2024-9506"], "threat_severity": "Low"}