CVE-2024-8998

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. The server uses the regex /{.*?}/ to match user-controlled strings. In the default JavaScript regex engine, this regex can take polynomial time to match certain crafted user inputs. As a result, an attacker can cause the server to hang for an arbitrary amount of time by submitting a specially crafted payload. This issue is fixed in version 1.4.26.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
lunary-ai	lunary-ai/lunary	>= unspecified, < 1.4.26

References

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-89997.5lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. Thi CVE-2024-90006.5In lunary-ai/lunary before version 1.4.26, the checklists.post() endpoint allows users to create or modify checklists without validating whe CVE-2024-90018.8A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracero CVE-2024-90027.8CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and av CVE-2024-90035.3A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function Attachmen CVE-2024-90049.8A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/D CVE-2024-90057.3CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely de CVE-2024-90068.8A vulnerability was found in jeanmarc77 123solar 1.8.4.5. It has been rated as critical. Affected by this issue is some unknown functionalit CVE-2024-90075.4A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.CVE-2024-90089.8A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. This vulnerability affects unknown code of t CVE-2024-90099.8A vulnerability, which was classified as critical, has been found in code-projects Online Quiz Site 1.0. This issue affects some unknown pro CVE-2024-90119.8A vulnerability, which was classified as critical, was found in code-projects Crud Operation System 1.0. Affected is an unknown function of