7.5

CVE-2024-21490

Exploit
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. 


**Note:**

This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Angularjs ≫ Angular.Js Version >= 1.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.89% 0.77
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
report@snyk.io 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113
Third Party Advisory
https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos
Third Party Advisory
Exploit
https://support.herodevs.com/hc/en-us/articles/25715686953485-CVE-2024-21490-AngularJS-Regular-Expression-Denial-of-Service-ReDoS
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html
https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771616