CVE-2024-45813

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. This may cause a denial of service in some instances. Users are advised to update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. There are no known workarounds for this issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
delvedor	find-my-way	< 8.2.2; = 9.0.0

References

Timeline

Published: Sep 18, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-458156.5Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the CVE-2024-458166.5Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to CVE-2024-458177.3In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, t CVE-2024-458186.5The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the (virtual) VGA is in "standard" mode. Locking involv CVE-2024-458195.5PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are th CVE-2024-45827.3A vulnerability classified as critical has been found in Faraday GM8181 and GM828x up to 20240429. Affected is an unknown function of the co CVE-2024-458239.8CVE-2024-45823 IMPACT An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secre CVE-2024-458249.8CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products. The vulnerability occurs when chained with Path Traver CVE-2024-458257.5CVE-2024-45825 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packe CVE-2024-458268.8CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager CVE-2024-458278.0Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Mesh Wi-Fi router RP562B firmware CVE-2024-458285.5In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request Bus c